Incidents in sector:
Osaka Metropolitan University said a suspected ransomware attack took down about 500 servers and may have exposed data on at least 130,000 students and staff.
Denmark's DTU said attackers used stolen credentials to breach its DTUBasen identity system, exposing CPR numbers and other personal data of up to 200,000 current and former users.
US K-12 software vendor Frontline Education began notifying school districts that a flaw in a third-party product let attackers access employee data, including Social Security numbers.
Online mathematics learning platform Mathspace disclosed that attackers exploited a vulnerability in its self-hosted Metabase reporting system to download contact data on 1,079,819 students, staff, parents and guardians in Australia and New Zealand.
The town of Andover, Massachusetts, and its public schools suffered a four-day network outage after an August cyberattack, and the WallStreet ransomware group later listed the town on its leak site claiming to hold town documents and data.
The UK Department for Education confirmed that attackers stole around 607,000 records from its helpdesk self-service portal and Turing Scheme portal, after the extortion group ExfilSquad claimed the attack.
Mount Royal University in Calgary confirmed that a ransomware group calling itself CMD Organization broke into its shared file storage, exfiltrated data belonging to current and former students and employees, and then deliberately wiped the original files to hamper recovery.
Google's Threat Intelligence Group disclosed that PRC-nexus actor UNC6508 spent more than a year inside U.S. and Canadian medical, academic and military-health research environments, compromising legacy REDCap servers, deploying custom INFINITERED malware and abusing Google Workspace email compliance rules to silently exfiltrate research and defense data.
The University of Nottingham confirmed a cyber incident after the ShinyHunters extortion group claimed to have stolen around 40 GB of data from its student-records system, exposing roughly 455,000 email addresses along with names, passport numbers, and fee-payment details.
The extortion group FulcrumSec claimed it stole roughly 4.8 terabytes of data from Singapore-based Global Schools Foundation after exploiting database credentials left unchanged since a 2022 breach, leaking 33,088 passport numbers belonging to children and parents and around 9.4 million internal messages when ransom negotiations collapsed.
On 22 May 2026, French professional-training provider Move Up Formation (moveup-formation.fr) was listed on a cybercrime forum, where attackers claimed to have stolen its full SQL database, customer records, the site's entire source code and Stripe administrator access.
Transitions Pro Centre-Val de Loire, the regional body that funds and supports employee career-retraining projects, was hit by the Prinz Eugen ransomware group, which claimed to have exfiltrated and encrypted hundreds of gigabytes of HR, financial and personal data and threatened to publish it.
On 14 May 2026, a threat actor known as ChimeraZ claimed a leak of around 1,600 researcher and staff profiles from the Collège de France, along with hundreds of megabytes of internal files pulled from a Nextcloud file-sharing instance.
On 14 May 2026, threat actor ChimeraZ leaked data from EFC Formation (École Française de Comptabilité), publishing a 1.3 GB archive on about 49,000 students and offering a second 41 GB set of 60,683 administrative and banking PDFs for sale.
On 14 May 2026, the cybercriminal ChimeraZ published roughly 11,000 documents (about 8.6 MB of JSON and PDF files) attributed to UPPCTSC (Union-prof.asso.fr), exposing training-center conventions, institution details, professional email addresses and timestamped download logs.
In early May 2026, the MedusaLocker ransomware gang listed the Académie de Montpellier / CSJM — a French public-school network around Béziers — on its leak site, claiming to have exfiltrated administrative documents and credentials, with reported exposure of 309 staff and 6,915 user accounts.
On 4 May 2026, Auto École du Lys — a French driving school in Dammarie-les-Lys — was hit by a confirmed data leak exposing files on its 220 candidates, including very recent records with driving-exam dates running up to April 2026.
Auto École du Moulin, a driving school in La Rochelle, France, suffered a data leak disclosed on 4 May 2026 that exposed personal records of 428 candidates, including their driving-licence examination history.
On 4 May 2026, a confirmed data leak at École de conduite Vincent, a driving school in Ancenis-Saint-Géréon (France), exposed the records of around 1,556 candidates, including names, dates of birth, emails, NEPH dossier numbers and detailed driving-exam histories.
On 4 May 2026, a threat actor using the alias Spirigatito claimed to publish roughly 55 GB attributed to France's École de Psychologues Praticiens (Psycho-Prat), including a student database, ID documents, IBANs and the site's full source code.
On 1 May 2026, a hacker claimed to have breached Faco Paris, a private higher education institution, and released a roughly 12 GB archive holding over 11,000 sensitive documents, 27,000+ source code files, identity papers, IBANs and student data.
ShinyHunters exploited Canvas's Free-For-Teacher account programme to exfiltrate 3.65 TB of data spanning approximately 275 million users across nearly 9,000 schools — names, email addresses, student IDs, and some private messages between students and teachers. Instructure reportedly paid the ransom and the data was destroyed.
On 29 April 2026, a threat actor published a partial database from toucan.campusfrance.org, the online application platform of France's public higher-education agency Campus France, exposing roughly 18,000 international student application files (about 430 MB of JSON) including names, emails, and chosen programs.
On 27 April 2026, a group calling itself LunarisSec claimed to have breached Université de Toulouse and leaked a database of academic profiles—names, emails, phone numbers and research details for faculty, doctoral candidates and staff—though the university issued no official confirmation.