✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Primary/Secondary Education
Breach intelligence, attack campaigns, and threat reports targeting the Primary/Secondary Education sector.
Explore Other Sectors
Primary/Secondary Education Threat Reports
Latvian National Sentenced for Ransomware Attacks by Former Conti Leaders
In May 2026, Latvian national Deniss Zolotarjovs was sentenced to 102 months in prison for his role in a series of ransomware attacks orchestrated by former leaders of the Conti ransomware group. Between June 2021 and August 2023, Zolotarjovs and his co-conspirators extorted nearly $16 million from over 54 companies, employing multiple aliases such as Conti, Karakurt, Royal, TommyLeaks, SchoolBoys Ransomware, and Akira. Notably, Zolotarjovs pressured victims by threatening to leak sensitive data, including children's health records, to coerce ransom payments. ([cyberscoop.com](https://cyberscoop.com/latvian-russia-ransomware-conti-sentenced/?utm_source=openai)) This case underscores the persistent threat posed by rebranded ransomware groups and highlights the importance of robust cybersecurity measures. Organizations must remain vigilant against evolving tactics employed by cybercriminals, especially those targeting sensitive data to maximize leverage.
2 months ago
Kill Chain
Instructure Data Breach: ShinyHunters Compromise 275 Million Records in 2026
In May 2026, Instructure, a leading educational technology company known for its Canvas learning management system, confirmed a significant data breach. The cyber extortion group ShinyHunters claimed responsibility, alleging the theft of data from nearly 9,000 schools worldwide, affecting approximately 275 million individuals. The compromised information includes names, email addresses, student ID numbers, and private messages exchanged between users. Instructure has stated that, to date, there is no evidence that passwords, dates of birth, government identifiers, or financial information were involved. The company has implemented patches, increased monitoring, and rotated application keys as precautionary measures. This incident underscores the escalating threat posed by cyber extortion groups targeting educational institutions. The breach highlights the critical need for robust cybersecurity measures and proactive incident response strategies within the education sector to protect sensitive personal information and maintain trust.
2 months ago
Kill Chain
Instructure Reports Cybersecurity Incident in May 2026
In May 2026, Instructure, the developer of the Canvas learning management system, disclosed a cybersecurity incident involving a criminal threat actor. The company is collaborating with external forensic experts to assess the breach's scope and mitigate its impact. As a precaution, services such as Canvas Data 2 and Canvas Beta have been placed under maintenance, potentially affecting tools dependent on API keys. ([status.instructure.com](https://status.instructure.com/?utm_source=openai)) This incident underscores the escalating trend of cyberattacks targeting educational technology firms, which manage extensive personal data of students and educators. The breach highlights the critical need for robust security measures and proactive threat detection within the edtech sector.
2 months ago
Kill Chain
Navigate360 P3 Global Intel Data Breach: A Wake-Up Call for Educational Cybersecurity
In March 2026, Navigate360's P3 Global Intel platform, an anonymous tip line used by over 30,000 schools and 5,000 public safety agencies, was reportedly breached by a hacker group known as Internet Yiff Machine. The attackers claimed to have exfiltrated approximately 93 gigabytes of data, including over 8 million law enforcement tips containing sensitive personally identifiable information (PII) of students and informants. This incident has raised significant concerns about the platform's security measures and the anonymity it promises to its users. The breach underscores the growing trend of cyberattacks targeting educational institutions, which have become increasingly frequent and sophisticated. The exposure of sensitive student data not only compromises individual privacy but also erodes trust in systems designed to enhance school safety. This incident highlights the urgent need for robust cybersecurity practices and compliance with data protection regulations within the education sector.
2 months ago
Kill Chain
Insider Threats in Cybersecurity: Lessons from the BlackCat Ransomware Case
In April 2026, Angelo Martino, a former ransomware negotiator at DigitalMint, pleaded guilty to collaborating with the BlackCat (ALPHV) ransomware group in 2023. Martino, along with accomplices Ryan Goldberg and Kevin Martin, exploited their insider positions to share confidential negotiation details with BlackCat operators, facilitating the extortion of higher ransom payments from U.S. organizations. Their victims included financial services firms, nonprofits, law firms, school districts, and medical facilities, with ransom payments exceeding $50 million. The trio operated as BlackCat affiliates, paying the ransomware administrators a 20% share of the proceeds. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/former-ransomware-negotiator-pleads-guilty-to-blackcat-attacks/?utm_source=openai)) This case underscores the critical need for stringent internal controls and trust verification within cybersecurity firms. The involvement of trusted insiders in cybercriminal activities highlights the evolving tactics of ransomware groups and the importance of comprehensive security measures to protect sensitive information and maintain organizational integrity.
3 months ago
Kill Chain
McGraw Hill's 2026 Data Breach: A Wake-Up Call for Third-Party Security
In April 2026, McGraw Hill, a leading educational publisher, experienced a data breach orchestrated by the cybercriminal group ShinyHunters. The attackers exploited a misconfiguration in McGraw Hill's Salesforce environment, gaining unauthorized access to a webpage hosted on the platform. This breach led to the exfiltration of personally identifiable information (PII) from approximately 13.5 million user accounts, including names, physical addresses, phone numbers, and email addresses. McGraw Hill confirmed the incident, emphasizing that their internal systems, customer databases, and educational platforms remained secure. The company attributed the breach to a broader issue affecting multiple organizations utilizing Salesforce, highlighting the risks associated with third-party service integrations. ([techradar.com](https://www.techradar.com/pro/security/this-activity-appears-to-be-part-of-a-broader-issue-education-company-mcgraw-hill-becomes-latest-to-see-its-salesforce-data-hacked?utm_source=openai)) This incident underscores the escalating threat posed by cybercriminal groups like ShinyHunters, who have shifted focus from traditional ransomware attacks to data extortion schemes. By exploiting vulnerabilities in widely-used platforms such as Salesforce, these actors can access vast amounts of sensitive data, posing significant risks to organizations and their customers. The McGraw Hill breach serves as a critical reminder for companies to rigorously assess and secure their third-party integrations to prevent similar incidents.
3 months ago
Kill Chain
McGraw-Hill's 2026 Data Breach: Lessons in Third-Party Platform Security
In April 2026, McGraw-Hill, a leading education company, experienced a data breach due to a misconfiguration in its Salesforce environment. The cybercriminal group ShinyHunters exploited this vulnerability to access internal data. McGraw-Hill confirmed that the breach did not affect its Salesforce accounts, customer databases, or internal systems, and that the exposed data was limited and non-sensitive. However, ShinyHunters claimed to possess 45 million Salesforce records containing personally identifiable information (PII), contradicting the company's statement. The group threatened to leak the stolen data by April 14 unless a ransom was paid. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/mcgraw-hill-confirms-data-breach-following-extortion-threat/?utm_source=openai)) This incident underscores the critical importance of securing third-party platforms and configurations. Misconfigurations in widely used services like Salesforce can serve as entry points for threat actors, leading to significant data breaches and extortion attempts. Organizations must prioritize regular audits and robust security measures to protect sensitive information.
3 months ago
Kill Chain
ShinyHunters Breach Infinite Campus: A 2026 Cybersecurity Wake-Up Call
In March 2026, Infinite Campus, a prominent K-12 student information system provider, experienced a data breach when the cybercriminal group ShinyHunters accessed an employee's Salesforce account. This unauthorized access exposed contact information of school staff, primarily publicly available data. ShinyHunters threatened to leak the stolen data unless a ransom was paid by March 25, but Infinite Campus refused to engage with the attackers. The company has since disabled certain customer-facing services and is working with affected districts to mitigate potential risks. This incident underscores the escalating threat posed by groups like ShinyHunters, who exploit misconfigured cloud platforms and social engineering tactics to infiltrate organizations. The breach highlights the critical need for robust security measures, including strict access controls and regular audits of cloud services, to protect sensitive information in the education sector.
4 months ago
Kill Chain
Europol's Project Compass Dismantles The Com Cybercriminal Network
In January 2025, Europol initiated 'Project Compass,' a collaborative effort involving law enforcement agencies from 28 countries, including the United States, to dismantle 'The Com,' a decentralized cybercriminal network notorious for targeting minors through cyberattacks, extortion, and exploitation. Over the course of a year, this operation led to the arrest of 30 individuals and the identification of 179 suspects associated with The Com. Authorities also identified 62 victims, directly safeguarding four of them from further harm. The Com's activities encompassed a range of cybercrimes, including ransomware attacks on prominent organizations and the coercion of minors into producing explicit content. ([cyberscoop.com](https://cyberscoop.com/project-compass-the-com-europol/?utm_source=openai)) The significance of this operation lies in its demonstration of the effectiveness of international cooperation in combating complex cybercriminal networks. The Com's exploitation of digital platforms to recruit and victimize young individuals underscores the urgent need for enhanced cybersecurity measures and public awareness to protect vulnerable populations from such threats. ([infosecurity-magazine.com](https://www.infosecurity-magazine.com/news/project-compass-com-arrests/?utm_source=openai))
4 months ago
Kill Chain
Europol's Project Compass: A Milestone in Combating The Com Cybercrime Network
In January 2025, Europol initiated Project Compass, a coordinated international effort involving 28 countries, including all Five Eyes nations, to dismantle 'The Com,' a decentralized network of minors and young adults engaged in cybercrime, extortion, and physical violence. Over the past year, this operation has led to the arrest of 30 individuals, the identification of 179 perpetrators, and the safeguarding of 62 victims. The Com operates across various online platforms, making it challenging to disrupt due to its fragmented structure. ([cyberscoop.com](https://cyberscoop.com/project-compass-the-com-europol/?utm_source=openai)) The significance of this operation lies in its demonstration of effective international collaboration in combating complex cybercriminal networks. The Com's activities, including high-profile ransomware attacks and exploitation of vulnerable individuals, underscore the evolving nature of cyber threats. Project Compass highlights the necessity for continuous global cooperation and adaptive strategies to address such multifaceted cybercrime challenges. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/02/27/europol-the-com-network-arrests/?utm_source=openai))
4 months ago
Kill Chain
Lazarus Group's Medusa Ransomware Attacks on Healthcare in 2026
In early 2026, the North Korean state-sponsored Lazarus Group initiated ransomware attacks using the Medusa ransomware variant, targeting healthcare organizations in the Middle East and the United States. These attacks involved data encryption and exfiltration, with ransom demands averaging $260,000. The group employed tools such as RP_Proxy, Mimikatz, and BLINDINGCAN to facilitate their operations. The healthcare sector's critical role and sensitive data made it a prime target, leading to significant operational disruptions and potential patient data breaches. This incident underscores a concerning trend of state-sponsored actors leveraging ransomware-as-a-service platforms to conduct financially motivated attacks. The collaboration between nation-state groups and established cybercriminal infrastructures highlights the evolving threat landscape, necessitating enhanced cybersecurity measures and international cooperation to mitigate such risks.
5 months ago
Kill Chain
Polish Authorities Arrest Phobos Ransomware Affiliate in 2026
In February 2026, Polish authorities arrested a 47-year-old man in the Małopolska region, suspected of affiliating with the Phobos ransomware group. The arrest was part of Operation Aether, a Europol-coordinated effort targeting Phobos affiliates. During the raid, officials seized computers and mobile phones containing stolen credentials, credit card numbers, and server IP addresses. The suspect allegedly used encrypted messaging to communicate with Phobos members and faces charges under Poland's Criminal Code for creating and distributing software designed to illegally access computer systems. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/02/17/phobos-ransomware-affiliate-arrested-in-poland/?utm_source=openai)) This arrest underscores the persistent threat posed by ransomware groups like Phobos, which have targeted over 1,000 victims globally, including critical infrastructure sectors such as healthcare and education. The incident highlights the importance of international collaboration in combating cybercrime and the need for organizations to bolster their cybersecurity defenses against evolving ransomware tactics. ([justice.gov](https://www.justice.gov/opa/pr/phobos-ransomware-affiliates-arrested-coordinated-international-disruption?utm_source=openai))
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports