FulcrumSec Double-Extortion Data Theft of Global Schools Foundation (GSF) EdTech Network via Unrotated 2022 MongoDB Credentials
FulcrumSec Double-Extortion Data Theft of Global Schools (TL-2026-1209) is a high-severity ransomware operation, first published 2026-07-11. It is attributed to FulcrumSec with high confidence, affects Global Schools Foundation GSF / Global Indian International School, maps to 22 MITRE ATT&CK techniques (T1021.007, T1048.003, T1078), and is covered by 9 detection rules and 21 indicators of compromise.
Key facts for TL-2026-1209
- Threat ID
- TL-2026-1209
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- 2026-07-11
- Last reviewed
- 2026-07-11
- Attribution
- FulcrumSec
- Attribution confidence
- HIGH
- Motivation
- FINANCIAL
- Target sectors
- education, government administration, finance, health, legal, technology, manufacturing
- Target regions
- Asia, Middle East, singapore, australia, North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 21
Malware and tooling in FulcrumSec Double-Extortion Data Theft of Global Schools
Malware and tooling: none (no encryptor used), Rclone - S1040
Cloud-native data-extortion group FulcrumSec breached Global Schools Foundation (GSF), a Singapore-headquartered international school network operating as Global Indian International School across Asia and the Middle East, exfiltrating 33,088 passport numbers, 221 million student attendance records, 9.4 million internal messages, 143,494 employee salary records, 168 AWS Secrets Manager entries, and 112 source-code repositories. The group discovered the intrusion path via MongoDB credentials that had gone unrotated since an unremediated August 2022 ransomware incident, then published the full dataset after GSF's negotiation collapsed and two court injunctions failed to suppress reporting.
How FulcrumSec Double-Extortion Data Theft of Global Schools works
FulcrumSec is a financially motivated, data-theft-only extortion group active since approximately September 2025 that has claimed roughly 25 named victims across 11+ countries without ever deploying a file-encrypting payload. The group's operating model — publicly documented across the Novo Nordisk, LexisNexis, and youX (formerly DRIVE IQ) intrusions — is 'steal and squeeze': gain access through one of three recurring doors (hardcoded/unrotated credentials in client-side JavaScript or source repositories, unpatched internet-facing applications such as the CVE-2025-55182 'React2Shell' React Server Components RCE, or openly misconfigured cloud storage/database services), enumerate and harvest cloud secrets (especially AWS Secrets Manager), move laterally across SaaS/cloud control planes (AWS, Azure, GCP, Databricks, MongoDB Atlas, GitHub, Hugging Face), sustain low-and-slow database reads over weeks to months of dwell time, exfiltrate bulk data with legitimate tooling (rclone) rather than custom malware, and finally extort victims through a branded leak site (fulcrumsec.net, clearnet + Tor mirror) organized into themed campaigns ('Index of /Shame', 'The Hardcoded Horror Show', 'Slopocalypse Now').
In the GSF case specifically, FulcrumSec identified that GSF (operating under the Global Indian International School brand, and legally referenced elsewhere as Global Schools Group / Global Schools Holdings) had suffered a prior ransomware intrusion in August 2022 that was never fully remediated: FulcrumSec found partially wiped MongoDB databases and the original 2022 ransom notes still present, and — critically — the MongoDB authentication credentials in use in 2026 were identical to the credentials valid in 2022. This is a textbook Valid Accounts (T1078) initial-access failure compounding a historical incident-response gap, consistent with FulcrumSec's broader 'Door 1' pattern of exploiting stale, unrotated secrets rather than developing novel exploits.
FulcrumSec made initial ransom contact with GSF in early May 2026 and disrupted GSF systems across multiple countries in early June 2026. GSF's negotiator conduct was independently characterized by investigative outlet DataBreaches.Net as erratic ('the most bizarre behaviour probably in the history of ransom negotiations'), and negotiations broke down without payment. FulcrumSec's ransom framing publicly compared the demand to 'less than the cost of a single year's tuition for a classroom.' GSF/Global Schools Group subsequently sought an ad-interim injunction from the High Court of Bombay (dated June 12, 2026) and a further injunction from the High Court of the Republic of Singapore (June 13, 2026) attempting to suppress reporting on the breach; DataBreaches.Net reported continuing to publish despite both injunctions.
The exposed dataset is unusually sensitive for a K-12/international-school population: 33,088 passport numbers spanning 66 nationalities (including minors and parents), 221 million student attendance records, 107,603 transport users' home addresses and GPS coordinates, 616,724 email attachments containing medical records and identity documents, 46,901 job applicant folders with 12,476 passport copies, 22,996 campus visitor photographs, 12,303 teacher passwords (99.98% of which were identical to one another, indicating shared/default credential hygiene failures), 9.4 million internal messages spanning 2006–2024, 143,494 employee salary records, 112 source-code repositories, and 168 AWS Secrets Manager entries — the latter giving FulcrumSec a plausible path to pivot into further GSF cloud infrastructure or downstream tenants.
GSF is one node in a broader FulcrumSec 2026 campaign that also compromised Novo Nordisk (approximately 1.3TB / 700,000 files, $25M demand, leak begun June 15, 2026, via a JavaScript-exposed AWS subdomain), LexisNexis Legal & Professional (February 24, 2026, via CVE-2025-55182 React2Shell RCE against an unpatched React frontend on AWS, yielding 3.9 million records including 118 U.S. government/.gov accounts and 53 plaintext cloud secrets), and Australian fintech youX/DRIVE IQ (February 2026, ~300GB across 22 production databases including a MongoDB Atlas cluster, affecting 444,000+ borrowers and ~800 broker organizations, 229,000+ driver's license numbers, and an estimated $15B in loan application data).
MITRE ATT&CK techniques used in TL-2026-1209
Lateral Movement
Exfiltration
T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol; T1537 Transfer Data to Cloud Account; T1567 Exfiltration Over Web Service
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Discovery
T1087.004 Cloud Account; T1526 Cloud Service Discovery; T1580 Cloud Infrastructure Discovery
Command and Control
Collection
T1119 Automated Collection; T1213 Data from Information Repositories; T1530 Data from Cloud Storage
Impact
T1486 Data Encrypted for Impact; T1657 Financial Theft
Credential Access
T1552.001 Credentials In Files; T1552.005 Cloud Instance Metadata API; T1552.007 Container API; T1555 Credentials from Password Stores
Resource Development
Reconnaissance
T1589 Gather Victim Identity Information; T1596 Search Open Technical Databases
Affected products and versions in FulcrumSec Double-Extortion Data Theft of Global Schools
- Global Schools Foundation — GSF / Global Indian International School network (MongoDB-backed student information and HR systems)
Vulnerable versions: MongoDB deployment with credentials unrotated since August 2022
Remediation for FulcrumSec Double-Extortion Data Theft of Global Schools
Patches
- Patch all React Server Components dependents (react-server-dom-webpack, react-server-dom-turbopack, react-server-dom-parcel versions 19.0.0–19.2.0) and Next.js 15.0.0–16.0.7 to versions remediating CVE-2025-55182 (React2Shell) if in use elsewhere in the organization's stack
Immediate actions
- Rotate ALL cloud credentials, API keys, and database authentication secrets that predate any prior incident, breach, or ransomware event — do not assume a past incident's remediation actually rotated credentials
- Audit MongoDB Atlas / self-hosted MongoDB deployments for anonymous or default authentication and confirm the deployed credential set differs from any historically compromised credential set
- Force password reset and eliminate credential reuse across all teacher/staff/student accounts; the GSF incident found 99.98% credential reuse among teacher passwords
- Enumerate and rotate all AWS Secrets Manager entries; assume any secret present at breach time is compromised
- Search public GitHub repositories and client-side JavaScript bundles for hardcoded API keys, JWT signing secrets, and cloud tokens
- Review AWS/Azure/GCP IAM roles for over-permissioned service accounts and machine identities used by FulcrumSec for lateral movement
Workarounds
- Restrict MongoDB and cloud database network access to VPN/private network only pending credential rotation
- Enable MFA on all cloud console and database administration accounts
Longer-term hardening
- Implement mandatory credential rotation SLAs tied to any confirmed security incident, not just the initially affected system
- Deploy cloud detection and response (CDR) tooling to baseline identity behavior and flag anomalous List/Describe/Get API calls across AWS, Azure, and GCP
- Monitor for bulk repository cloning and unusual data egress volumes from cloud storage and databases (rclone-style low-and-slow exfiltration)
- Establish a formal post-incident verification process confirming remediation actions (credential rotation, patching) were actually completed and did not silently fail
- Apply data minimization and retention limits to student/employee PII, particularly passport numbers, GPS/location data, and medical records
Weaknesses (CWE) in FulcrumSec Double-Extortion Data Theft of Global Schools
CWE-798, CWE-521, CWE-262, CWE-284
Timeline of FulcrumSec Double-Extortion Data Theft of Global Schools
- GSF suffers an earlier ransomware attack; MongoDB databases are partially wiped and ransom notes left, but the incident is never fully remediated and MongoDB credentials are never rotated.
- FulcrumSec begins operating as a data-theft extortion group, exploiting unrotated cloud credentials and misconfigurations rather than deploying encryptors.
- FulcrumSec exfiltrates ~300GB from Australian fintech youX (formerly DRIVE IQ) across 22 production databases including a MongoDB Atlas cluster, affecting 444,000+ borrowers.
- FulcrumSec exploits CVE-2025-55182 (React2Shell) against an unpatched React frontend on LexisNexis Legal & Professional's AWS infrastructure, exfiltrating 3.9 million records and 53 plaintext cloud secrets.
- FulcrumSec makes initial contact with Global Schools Foundation (GSF) and presents ransom demands, having discovered the still-valid 2022 MongoDB credentials.
- FulcrumSec's attack on GSF is publicly disclosed/discovered; critical systems disrupted across GSF's international school network in multiple countries.
- Global Schools Group obtains an ad-interim injunction from the High Court of Bombay attempting to suppress reporting on the breach.
- Global Schools Group obtains a further injunction from the High Court of the Republic of Singapore.
- FulcrumSec begins leaking Novo Nordisk data (~1.3TB / 700,000 files) after a $25M ransom demand is refused.
- Resecurity publishes 'Cybercriminals Are Targeting EdTech,' detailing the GSF breach scope (33,088 passport numbers, 221M attendance records, 168 AWS Secrets Manager entries) alongside the wider FulcrumSec campaign.
- DataBreaches.Net reports that the two court injunctions obtained by Global Schools Group have not meaningfully changed reporting and may backfire.
- DataBreaches.Net reports Global Schools Holdings continuing to cite the two injunctions in an effort to chill ongoing reporting.
Sources cited for FulcrumSec Double-Extortion Data Theft of Global Schools
- Cybercriminals Are Targeting EdTech: Data Breaches and Ransomware Attacks on the Rise
- Malpedia FulcrumSec actor library entry
- FulcrumSec Targets Global Schools Foundation in Ransomware Assault
- After a Massive Hack, Global Schools Group's Negotiator Acted "Bizarrely." It Didn't End Well for Them.
- Global Schools Group Obtained Two Court Injunctions That Didn't Seem to Change Much—and Might Backfire
- Global Schools Holdings Cites Two Injunctions in a Bid to Chill Our Reporting. It Won't Work.
- Victim: Global Schools Foundation – fulcrumsec (ransomware.live)
- Ransomware Group fulcrumsec Hits: Global Schools Foundation
- Massive Data Breach at Global Schools Foundation Exposes Sensitive Student and Employee Data
- EdTech Faces a Cybersecurity Crisis: Data Breaches Surge
- FulcrumSec Targets Global Schools Foundation in Ransomware Assault (Malware News mirror)
- FulcrumSec: The Cloud Extortion Group Behind 21 Victims and Counting
- The FulcrumSec playbook: How to detect and stop the group behind the Novo Nordisk breach
- FulcrumSec: Threat Actor Profile
- FulcrumSec Hackers Take Credit for Novo Nordisk Data Heist
More in ransomware
- Magniber Ransomware: Rewritten 2022 Variant Uses MSI Installer, AES-NI Encryption, and UAC Bypass
- Hyadina Rebrands Beast Ransomware as 'GodDamn' and Uses PoisonX Signed Kernel Driver to Disable Endpoint Defenses
- DragonForce Ransomware Attack on RubberMill, Inc. — ~340GB Data Exfiltration Including PII, Credentials, CAD Files with Defense Mil-Spec References
- Vexy Ransomware hits Mega Velocity — 46.68 GB exfiltrated, double extortion
- Rhysida Ransomware Campaign Targeting German Public Administration (Stuttgart and Berlin, 2026)
Detection coverage for TL-2026-1209
As of 2026-07-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1209 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.