Lockbit5 ransomware group lists shottermill-jun.surrey.sch.uk on its leak site

• Ransomware group: Lockbit5
• Country: United Kingdom
• Sector: Education
• Announcement date: June 11, 2026

Lockbit5 claims attack on Shottermill Junior School

The Lockbit5 ransomware group has listed the educational institution shottermill-jun.surrey.sch.uk on its leak site. According to the announcement made by the group, the organization has been targeted in a cyberattack, and the threat actor has threatened to publish the institution's data.

This type of announcement is a common tactic used by ransomware groups operating under a Ransomware-as-a-Service (RaaS) model. In these scenarios, attackers often employ a "double extortion" strategy. This method involves not only encrypting an organization's internal systems to disrupt operations but also stealing sensitive data to use as leverage. By threatening to leak the stolen information on a public platform, the attackers aim to pressure the victim into paying a ransom to prevent the disclosure of private information.

The details of the claim

The Lockbit group announced the listing of shottermill-jun.surrey.sch.uk on its leak site on June 11, 2026. While the announcement was made in June, the group claims that they obtained access to the institution's network much earlier, specifically on May 17, 2026. This gap between the initial intrusion and the public listing is a common occurrence in ransomware campaigns, as attackers often spend time navigating the network and exfiltrating data before making their demands public.

Regarding the specifics of the breach, no information has been provided regarding the nature of the allegedly leaked data. The screenshot provided by the group shows the general landing page of the leak site and does not contain any specific data samples. Consequently, the listing names no data types.

Organization profile

Shottermill Junior School is a primary school located in Surrey, England. It provides educational services for children aged 7 to 11.

Risk assessment and sector implications

Given that the institution operates in the education sector, the alleged leak may pose risks to the privacy of student and staff data. Educational institutions are often targeted by cybercriminals because they manage significant amounts of personally identifiable information (PII), which can be highly valuable on illicit markets. The potential exposure of such data can lead to secondary risks, including identity theft and targeted phishing attacks against the school community.

As the institution is based in the United Kingdom, a potential data breach may be subject to UK GDPR regulations and trigger legal processes. Organizations operating within this jurisdiction must adhere to strict data protection standards, and any significant breach involving personal data typically requires notification to the relevant regulatory authorities and the affected individuals.

Lockbit is a RaaS group that has been monitored since 2019. It is reported to have resumed operations with a new version after its infrastructure was disrupted in February 2024. This resilience demonstrates the evolving nature of ransomware threats, where groups often rebuild their infrastructure to continue their operations after law enforcement interventions.

To defend against such threats, organizations in the education sector can implement various defensive steps. These include maintaining robust backup solutions that are isolated from the main network, implementing multi-factor authentication (MFA) across all services, and conducting regular security awareness training for staff and students to recognize phishing attempts. Furthermore, continuous monitoring of network traffic and regular vulnerability assessments can help identify and mitigate potential entry points for attackers before they can gain unauthorized access.