# FulcrumSec Double-Extortion Data Theft of Global Schools Foundation (GSF) EdTech Network via Unrotated 2022 MongoDB Credentials

> Cloud-native data-extortion group FulcrumSec breached Global Schools Foundation (GSF), a Singapore-headquartered international school network operating as Global Indian International School across Asia and the Middle East, exfiltrating 33,088 passport numbers, 221 million student attendance records, 9.4 million internal messages, 143,494 employee salary records, 168 AWS Secrets Manager entries, and 112 source-code repositories. The group discovered the intrusion path via MongoDB credentials that had gone unrotated since an unremediated August 2022 ransomware incident, then published the full dataset after GSF's negotiation collapsed and two court injunctions failed to suppress reporting.

- **Published:** 2026-07-11T00:00:00Z
- **Last reviewed:** 2026-07-11T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1209
- **ID:** TL-2026-1209
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** FulcrumSec
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-55182

## Description

FulcrumSec is a financially motivated, data-theft-only extortion group active since approximately September 2025 that has claimed roughly 25 named victims across 11+ countries without ever deploying a file-encrypting payload. The group's operating model — publicly documented across the Novo Nordisk, LexisNexis, and youX (formerly DRIVE IQ) intrusions — is 'steal and squeeze': gain access through one of three recurring doors (hardcoded/unrotated credentials in client-side JavaScript or source repositories, unpatched internet-facing applications such as the CVE-2025-55182 'React2Shell' React Server Components RCE, or openly misconfigured cloud storage/database services), enumerate and harvest cloud secrets (especially AWS Secrets Manager), move laterally across SaaS/cloud control planes (AWS, Azure, GCP, Databricks, MongoDB Atlas, GitHub, Hugging Face), sustain low-and-slow database reads over weeks to months of dwell time, exfiltrate bulk data with legitimate tooling (rclone) rather than custom malware, and finally extort victims through a branded leak site (fulcrumsec.net, clearnet + Tor mirror) organized into themed campaigns ('Index of /Shame', 'The Hardcoded Horror Show', 'Slopocalypse Now').

In the GSF case specifically, FulcrumSec identified that GSF (operating under the Global Indian International School brand, and legally referenced elsewhere as Global Schools Group / Global Schools Holdings) had suffered a prior ransomware intrusion in August 2022 that was never fully remediated: FulcrumSec found partially wiped MongoDB databases and the original 2022 ransom notes still present, and — critically — the MongoDB authentication credentials in use in 2026 were identical to the credentials valid in 2022. This is a textbook Valid Accounts (T1078) initial-access failure compounding a historical incident-response gap, consistent with FulcrumSec's broader 'Door 1' pattern of exploiting stale, unrotated secrets rather than developing novel exploits.

FulcrumSec made initial ransom contact with GSF in early May 2026 and disrupted GSF systems across multiple countries in early June 2026. GSF's negotiator conduct was independently characterized by investigative outlet DataBreaches.Net as erratic ('the most bizarre behaviour probably in the history of ransom negotiations'), and negotiations broke down without payment. FulcrumSec's ransom framing publicly compared the demand to 'less than the cost of a single year's tuition for a classroom.' GSF/Global Schools Group subsequently sought an ad-interim injunction from the High Court of Bombay (dated June 12, 2026) and a further injunction from the High Court of the Republic of Singapore (June 13, 2026) attempting to suppress reporting on the breach; DataBreaches.Net reported continuing to publish despite both injunctions.

The exposed dataset is unusually sensitive for a K-12/international-school population: 33,088 passport numbers spanning 66 nationalities (including minors and parents), 221 million student attendance records, 107,603 transport users' home addresses and GPS coordinates, 616,724 email attachments containing medical records and identity documents, 46,901 job applicant folders with 12,476 passport copies, 22,996 campus visitor photographs, 12,303 teacher passwords (99.98% of which were identical to one another, indicating shared/default credential hygiene failures), 9.4 million internal messages spanning 2006–2024, 143,494 employee salary records, 112 source-code repositories, and 168 AWS Secrets Manager entries — the latter giving FulcrumSec a plausible path to pivot into further GSF cloud infrastructure or downstream tenants.

GSF is one node in a broader FulcrumSec 2026 campaign that also compromised Novo Nordisk (approximately 1.3TB / 700,000 files, $25M demand, leak begun June 15, 2026, via a JavaScript-exposed AWS subdomain), LexisNexis Legal & Professional (February 24, 2026, via CVE-2025-55182 React2Shell RCE against an unpatched React frontend on AWS, yielding 3.9 million records including 118 U.S. government/.gov accounts and 53 plaintext cloud secrets), and Australian fintech youX/DRIVE IQ (February 2026, ~300GB across 22 production databases including a MongoDB Atlas cluster, affecting 444,000+ borrowers and ~800 broker organizations, 229,000+ driver's license numbers, and an estimated $15B in loan application data).

## MITRE ATT&CK

- T1596 Search Open Technical Databases
- T1589 Gather Victim Identity Information
- T1588.002 Tool
- T1078 Valid Accounts
- T1190 Exploit Public-Facing Application
- T1552.001 Credentials In Files
- T1552.005 Cloud Instance Metadata API
- T1552.007 Container API
- T1555 Credentials from Password Stores
- T1580 Cloud Infrastructure Discovery
- T1526 Cloud Service Discovery
- T1087.004 Cloud Account
- T1021.007 Cloud Services
- T1530 Data from Cloud Storage
- T1213 Data from Information Repositories
- T1119 Automated Collection
- T1102 Web Service
- T1567 Exfiltration Over Web Service
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1537 Transfer Data to Cloud Account
- T1657 Financial Theft
- T1486 Data Encrypted for Impact

## Sources

- [Cybercriminals Are Targeting EdTech: Data Breaches and Ransomware Attacks on the Rise](https://www.resecurity.com/blog/article/cybercriminals-are-targeting-edtech-data-breaches-and-ransomware-attacks-on-the-rise)
- [Malpedia FulcrumSec actor library entry](https://malpedia.caad.fkie.fraunhofer.de/library/a17e110b-3dd8-466b-85fe-72eeba8256e1/)
- [FulcrumSec Targets Global Schools Foundation in Ransomware Assault](https://www.dexpose.io/fulcrumsec-targets-global-schools-foundation-in-ransomware-assault/)
- [After a Massive Hack, Global Schools Group's Negotiator Acted "Bizarrely." It Didn't End Well for Them.](https://databreaches.net/2026/06/12/after-a-massive-hack-global-schools-groups-negotiator-acted-bizarrely-it-didnt-end-well-for-them/)
- [Global Schools Group Obtained Two Court Injunctions That Didn't Seem to Change Much—and Might Backfire](https://databreaches.net/2026/06/20/global-schools-group-obtained-two-court-injunctions-that-didnt-seem-to-change-much-and-might-backfire/)
- [Global Schools Holdings Cites Two Injunctions in a Bid to Chill Our Reporting. It Won't Work.](https://databreaches.net/2026/07/02/global-schools-holdings-cites-two-injunctions-in-a-bid-to-chill-our-reporting-it-wont-work/)
- [Victim: Global Schools Foundation – fulcrumsec (ransomware.live)](https://www.ransomware.live/id/R2xvYmFsIFNjaG9vbHMgRm91bmRhdGlvbkBmdWxjcnVtc2Vj)
- [Ransomware Group fulcrumsec Hits: Global Schools Foundation](https://www.hookphish.com/blog/ransomware-group-fulcrumsec-hits-global-schools-foundation/)
- [Massive Data Breach at Global Schools Foundation Exposes Sensitive Student and Employee Data](https://techjacksolutions.com/scc-intel/massive-data-breach-at-global-schools-foundation-exposes-sensitive-student-and-employee-data/)
- [EdTech Faces a Cybersecurity Crisis: Data Breaches Surge](https://securityaffairs.com/193777/data-breach/edtech-faces-a-cybersecurity-crisis-data-breaches-surge.html)
- [FulcrumSec Targets Global Schools Foundation in Ransomware Assault (Malware News mirror)](https://malware.news/t/fulcrumsec-targets-global-schools-foundation-in-ransomware-assault/107807)
- [FulcrumSec: The Cloud Extortion Group Behind 21 Victims and Counting](https://www.moxfive.com/blog/who-is-fulcrumsec-inside-the-cloud-extortion-group-behind-21-victims-and-counting)
- [The FulcrumSec playbook: How to detect and stop the group behind the Novo Nordisk breach](https://www.sysdig.com/blog/the-fulcrumsec-playbook-how-to-detect-and-stop-the-group-behind-the-novo-nordisk-breach)
- [FulcrumSec: Threat Actor Profile](https://breachnews.com/threat-actors/fulcrumsec/)
- [FulcrumSec Hackers Take Credit for Novo Nordisk Data Heist](https://securitypointbreak.com/2026/06/16/fulcrumsec-hackers-take-credit-for-novo-nordisk-data-heist/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1209