Cyber Incident Victim: De Montfort School
Date:
Jul 2022
Location:
United Kingdom
Summary
A ransomware group known as Vice Society leaked student data from multiple UK educational institutions, including De Montfort School, on the dark web following refused ransom demands. The breach exposed personal information of thousands of students across several schools and a sixth-form college, with the attackers publicly disclosing the stolen data as part of their extortion tactics.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
In early July 2022, the ransomware group Vice Society executed a cyberattack against multiple educational institutions in the United Kingdom, including The De Montfort School. The attackers compromised sensitive student data and threatened to release it unless ransom demands were met. Vice Society subsequently published the stolen information on their dedicated dark web leak site after the targeted schools refused to pay. The breach impacted thousands of students across five schools and one sixth-form college, with Pilton Community College, St Paul’s Catholic College, and Carmel College confirmed as additional victims alongside The De Montfort School. The group employed their standard operational pattern of exfiltrating data before deploying ransomware, leveraging the threat of public exposure to pressure victims.
The data leak exposed personal information belonging to students, though specific data categories were not detailed in available reports. This exposure created immediate risks of identity theft and privacy violations for affected individuals. The incident gained public attention through media coverage by the Daily Mail, which documented the scope of Vice Society's campaign against UK educational institutions. No information was disclosed regarding technical remediation efforts, law enforcement involvement, or post-breach support for victims. The schools' collective refusal to negotiate with the threat actors resulted in the permanent availability of stolen data on criminal platforms. The attack highlighted vulnerabilities in the education sector's cybersecurity infrastructure while demonstrating Vice Society's continued targeting of schools as high-impact extortion opportunities.