St Thomas More Catholic High School targeted by Qilin ransomware group

• Ransomware group: Qilin
• Country: United Kingdom
• Sector: Education
• Announcement date: August 10, 2025

Qilin ransomware group claims data breach at St Thomas More Catholic High School

The Qilin ransomware group has officially listed St Thomas More Catholic High School on its dedicated leak site. According to the announcement made by the threat actors, the institution's data has been compromised, marking a significant security incident for the educational entity. This disclosure follows a pattern of behavior common among modern ransomware groups that utilize leak sites to exert pressure on their targets through the threat of public data exposure.

The group's announcement was posted on August 10, 2025. While the public announcement occurred in August, the group claims that the actual intrusion and subsequent access to the institution's internal systems occurred much earlier, specifically on June 3, 2025. This gap between the initial attack and the public disclosure is a common tactic used by ransomware operators to maximize the impact of their extortion attempts.

Details of the claimed attack and stolen data

The Qilin ransomware group asserts that they successfully gained unauthorized access to the institution's network and extracted sensitive information. The group's post specifically mentions that they have obtained documents related to the school's administrative and financial processes. The presence of document samples in the group's post suggests a level of verification intended to demonstrate the legitimacy of their claims to the public and the victim.

The data allegedly exfiltrated during this incident is quite broad in scope, potentially impacting various stakeholders within the school community. Based on the information provided by the attackers, the stolen data is claimed to include:

• Student personal data
• Employee personal data
• Financial records
• Family contact information

The inclusion of such diverse data types highlights the sensitive nature of the information held by educational institutions. When personal identifiers, contact details, and financial records are compromised, the scope of the breach extends beyond the organization itself to the individuals represented in those files.

Risk assessment and implications for the sector

This breach poses several significant risks to the individuals involved. The exposure of personal information belonging to students, their families, and school employees significantly increases the risk of identity theft. Furthermore, the disclosure of the organization's financial records could potentially impact the school's operational processes and its overall reputation. Such incidents can lead to a loss of trust among parents, students, and staff members.

The Qilin group appears to be employing a double extortion strategy. In this model, attackers do not just encrypt an organization's data to disrupt operations; they also steal the data to threaten its public release. This method increases the pressure on organizations, as even if backups are available to restore systems, the threat of a data leak remains a potent weapon for the attackers. This tactic often leads to an increase in targeted phishing attacks, as criminals may use the stolen contact information to craft highly convincing fraudulent communications.

As an educational institution operating in the US, this incident may be subject to evaluation under state-level data protection laws and regulations concerning the privacy of educational records. Organizations in the education sector should remain vigilant and consider implementing robust defensive measures, such as multi-factor authentication, regular security awareness training, and comprehensive data encryption, to mitigate the risks of such targeted attacks. Public information regarding the specific capabilities and methodologies of the Qilin group remains limited.