School Login Sites Hacked in Extortion Plot

Login portals for an education technology platform were defaced across approximately 330 educational institutions. This incident follows a previous breach of the same platform.

The defacement, visible for about 30 minutes, displayed an extortion message threatening to leak stolen data if a ransom is not paid by May 12, 2026. The message indicated that the threat actors had previously contacted the platform regarding a resolution.

Reports suggest a vulnerability in the platform's systems allowed for the modification of login portals and the display of the extortion message within the platform's application. The platform was subsequently taken offline.

This event is linked to an earlier cyberattack where threat actors claimed to have stolen 280 million student and staff records from 8,809 educational entities. The stolen data reportedly includes user records, private messages, and enrollment information.

The platform confirmed data thesources from the prior attack and is investigating the incident. The threat actor group involved has a history of data thesources and extortion, osourcesen targeting cloud-based SaaS environments and utilizing stolen authentication tokens.