A demand denominated in bitcoin changes value while the victim decides. Neither the price nor the volume is verified.
Two days closed, summer programmes cancelled. A school that cannot confirm who may collect a child cannot responsibly open.
1.4 million addresses, and instructor payout methods. A card can be reissued; a bank account configured to receive money cannot.
455,000 addresses across decades of cohorts. An alumni relationship has no end date and no opt-out.
No intrusion of its own — a dependency with a deadline, hitting the one week in the academic year with no slack in it.
The group claimed 3.65 TB across ~8,800 institutions, defaced hundreds of login portals, then settled. The proof of deletion was a log file it wrote itself.
A month between attack and claim. Leak-site listings record negotiation failures, not attacks — and that biases everyone’s data.
13.5 million accounts reachable because the environment was configured to permit it. Nobody had to be clever.
Minors’ records, federated universities, thin staffing and heavy vendor dependence. Exposure and capacity moving in opposite directions.
Education fails closed while other sectors degrade. The fix is not detection — it is an offline copy of the data needed to open safely.
Around 32% of K-12 breaches originate at a vendor. Districts outsourced the technology and kept the accountability.
Ten months in a diplomatic academy’s education platform, touching 360 serving diplomats. The coursework was never the point; the roster was.
62 million student records through a support portal with no second factor. Credit monitoring requires a credit file, and a nine-year-old has none.
Princeton was compromised. The difference was what happened in the next twenty-four hours.
A person who graduated in 1975 may not know a development office holds a file on them, and has no mechanism to be removed from it.
Twenty-four hours is not an improvement on 102 days. It is a different regime.
These are not poor institutions. The money exists and does not flow to the systems that hold the people.
The reached system is almost never the one the security programme was built around.
A wealth capacity assessment is an estimate of what somebody could afford, recorded about them, which they have never seen.
A university ERP holds staff, students, alumni donors and grant administration. One flaw reached all of it.
The corpus’s central complaint — harm that cannot be quantified is not compensated — has an exception here.
A university discovering redirected payroll has suffered an incident. An employee who was not paid has suffered a loss on a specific date.
For a child the loss is maximally unquantifiable: real, permanent, and not yet manifest.
Extortion works by finding who cannot refuse. This is the endpoint of that logic.
No zero-day, no custom tooling, no organisation. One person in their late teens and a credential without MFA.
What $2.85 million bought was a recording, made by the counterparty, of an unverifiable claim. The second demand went to districts that had never paid.
The email store is worth more than the institution is — and the exposed parties are people who simply wrote to an academic.
A support portal is a production system. 18,000 schools did not make 18,000 bad decisions — but the security did not scale with the concentration.
The refusal was right. The people who paid for it were children who cannot freeze a credit file.