Safepay claims data breach against rhschool.org
The Safepay ransomware group has listed 12 GB of data allegedly belonging to rhschool.org on their leak site.
- Published
- 2 min read
- 2 min read
- Ransomware group: Safepay
- Country: United States
- Sector: Education
- Announcement date: July 22, 2025
Safepay claims data breach against rhschool.org
The Safepay ransomware group has listed the domain rhschool.org on its leak platform, claiming to have exfiltrated a significant amount of data from the organization. This announcement, which appeared on the group's leak site on July 22, 2025, marks a new development in the group's ongoing activities.
Details of the alleged attack
According to the claim made by the threat actor known as Safepay, the breach occurred around May 21, 2025. In their listing, the group has provided specific financial details regarding the target, noting that the organization's annual revenue is 5 million dollars. This type of information is often used by ransomware groups to establish a baseline for their extortion demands, although no specific ransom demand has been publicly disclosed in this instance.
The group's listing follows a pattern seen with many modern ransomware operations. These groups often use leak sites to host information about their victims, creating public pressure to force organizations into paying ransoms. By publishing the names of organizations and details about their financial standing, these actors aim to maximize the visibility and impact of their attacks.
Data involved in the claim
Regarding the content of the alleged leak, the group claims to have stolen 12 GB of data. However, there is no detailed information regarding the specific content or nature of the alleged leaked data. The available evidence, such as the screenshots provided by the group, only indicates the existence of a 12 GB ZIP file.
The listing names no specific data types.
About rhschool.org
Riverwood International Charter School is a public high school located in Georgia, United States. It is an educational institution that offers a variety of academic and extracurricular programs to its students.
Implications and risks for educational institutions
The Safepay group is known to operate using a double-extortion model. In this model, attackers do not just encrypt an organization's files to disrupt operations; they also steal sensitive data and threaten to release it publicly if a ransom is not paid. The public release of stolen data can lead to significant reputational damage for an organization. For an educational institution, the stakes are particularly high. If a breach includes student or staff data, it could trigger legal processes under state-level data protection laws in the US and regulations such as the Family Educational Rights and Privacy Act (FERPA).
The publication of such data may create secondary risks for the organization's stakeholders, including the potential for identity theft and targeted phishing attacks. These secondary attacks often target the individuals whose information was compromised, using the stolen data to craft highly convincing fraudulent communications.
The Safepay group has been active since late 2024. It is assessed that such leaks are intended to exert pressure on the organization's operational continuity. To defend against such threats, organizations in the education sector typically focus on robust data protection strategies, including regular backups, network segmentation, and strict access controls to limit the movement of attackers within a network. Furthermore, monitoring for unauthorized data exfiltration and maintaining a comprehensive incident response plan are critical components of a modern cybersecurity posture designed to mitigate the impact of ransomware and data theft.