1 ACT Driving Schools targeted in ransomware leak announcement by killsec

• Ransomware group: killsec
• Country: United States
• Sector: Education
• Announcement date: September 10, 2025

Killsec claims data breach at 1 ACT Driving Schools

The ransomware group known as killsec has officially listed 1 ACT Driving Schools on its leak site, claiming to have successfully targeted the educational institution. This announcement, published on September 10, 2025, suggests a significant breach of the organization's data. According to the group, the incident occurred on the same day the announcement was made, September 10, 2025. The group is demanding a ransom payment of 50,000 EUR in exchange for the data they claim to possess.

Ransomware attacks of this nature often follow a pattern of double extortion. In such scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data to use as leverage. By threatening to release private information on a public leak site, attackers aim to increase the pressure on the victim to meet their financial demands. This tactic is particularly effective against organizations that handle high volumes of personally identifiable information (PII), as the reputational and legal consequences of a public leak can be devastating.

Details of the alleged data leak

The killsec group has provided samples of documents to support their claims, which appear to be related to the institution's driver education operations. These samples include screenshots of driver education completion certificates that have been approved by the Georgia Department of Driver Services. The presence of these official documents indicates that the stolen data is highly sensitive and directly linked to the core administrative functions of the school.

The information allegedly contained within these files includes several critical categories of data that could be used for malicious purposes. The data types identified in the leak include:

• Student personal information
• Social security numbers (SSN)
• Course attendance and completion records

The exposure of social security numbers and full names presents a severe risk to the individuals involved. Such data is a primary target for cybercriminals looking to engage in identity theft and various forms of financial fraud. When sensitive identifiers like SSNs are leaked, the window for exploitation remains open for a long period, as these numbers are difficult for individuals to change.

The organization profile

1 ACT Driving Schools is an educational institution based in Atlanta, Georgia, USA. The organization specializes in providing driver education and DUI (driving under the influence) risk reduction programs to the local community.

Risk assessment and industry implications

The alleged leak of student identification and sensitive personal information carries a high level of risk for the affected individuals. The exposure of such data creates an environment ripe for identity theft and fraudulent activities. Furthermore, because the institution operates within the United States, it may face significant legal challenges. The breach could potentially trigger legal sanctions under various state-level data protection laws as well as federal regulations governing the handling of sensitive personal information.

The threat actor involved, killsec, is a group that emerged in 2023. Reports suggest that the group has hacktivist origins and currently operates by providing ransomware-as-a-service (RaaS). In a RaaS model, developers maintain the ransomware infrastructure and lease it to affiliates who carry out the actual attacks, allowing for a more scalable and professionalized criminal operation.

For organizations operating in the education and training sector, this incident highlights the necessity of robust cybersecurity frameworks. Following a breach, it is common practice for institutions to notify their clients and affected students to mitigate potential harm. Organizations must also conduct thorough reviews of their existing security measures to identify vulnerabilities that may have been exploited. Implementing multi-factor authentication, maintaining strict access controls, and ensuring regular, encrypted backups are standard defensive steps that can help protect against the unauthorized exfiltration of sensitive student records.