Global Schools Group Data Breach Exposes Sensitive Data of 183,000+ Users Across 12 Brands A massive data breach at Global Schools Group (GSG), a multinational K-12 education network, has exposed the personal and sensitive information of over 183,000 students, parents, and staff across 12 school brands and 60+ campuses in 10 countries. The breach, first reported on June 12, was carried out by the threat actor FulcrumSec, which leaked the data and later provided detailed findings to DataBreaches. ### Scope of the Breach GSG operates a centralized AWS database shared across all its brands, meaning the breach affected every school in its network. The compromised data includes: - 183,164 user accounts (83,132 students, 88,856 parents, 11,176 staff) - 35,938 student enrollment records containing passport numbers, government IDs (Aadhaar, NRIC, Emirates ID), and family PII - 9.4 million internal messages (2006–2024), including medical and disciplinary disclosures - 8.6 million attendance records - 122,862 Twilio SMS messages - 112 source code repositories and 168 AWS secrets - 46,901 job applicant folders with ID document scans - 11,176 staff password hashes (SHA-256) ### Affected Brands & Data Exposure While all 12 GSG brands were impacted, Global Indian International School (GIIS) the group’s flagship brand suffered the deepest exposure, including: - ~33,000 passport numbers (students, parents) - 23,856+ government IDs (Aadhaar, NRIC, Emirates ID) - 9.4 million internal messages (including medical and counseling records) - 626,000 email attachments Other affected brands include: - One World International School (OWIS) – Exposed 9,000+ student/parent records (names, DOB, addresses, password hashes) and 5,896 messages. - Glendale Academy – 4,800+ records with Aadhaar numbers and 512 internal messages. - Additional brands (Vikaasa, Harrods, CIS Manila, Dwight Seoul, etc.) also had account-level data compromised. ### Geographic Impact The breach spans 10 countries, with the highest exposure in: - Singapore (GIIS, OWIS) - India (GIIS, Glendale, Vikaasa, Global/Witty) - UAE (GIIS Abu Dhabi/Dubai, Glendale Dubai) - Japan, Malaysia, Cambodia, Philippines, South Korea, Saudi Arabia, UK Student nationalities in the data span 66 countries, indicating a truly global impact. ### How the Breach Occurred FulcrumSec accessed the data through compromised credentials tied to GSG’s shared AWS infrastructure. The threat actor used AI-assisted crawling to extract records, though some minor errors in deduplication may exist. A second report will provide further details on the remaining affected brands.