Global Schools Group Suffers Massive Data Breach Exposing 183,000+ Accounts A recent cyberattack on Global Schools Group (GSG), a network of international schools, has exposed sensitive data belonging to over 183,000 students, parents, and staff across 12 school brands. The breach, attributed to the hacking group FulcrumSec, resulted in the exfiltration of vast amounts of personal and operational data, including: - 83,132 student accounts and 35,938 detailed enrollment records containing passport numbers, government IDs, and extended family PII. - 88,856 parent accounts and 11,176 staff/teacher/admin accounts. - 9.4 million internal messages (2006–2024), including sensitive communications about students’ mental health and family matters. - 8.6 million attendance records, 122,862 Twilio SMS messages, and 112 source code repositories. - 168 AWS secrets and 46,901 job applicant document folders. The affected schools span multiple countries, including India, Cambodia, the Philippines, South Korea, the UAE, Malaysia, and the UK. Notably, Regent International School in Malaysia had ~1,820 duplicate records, inflating the total count. FulcrumSec described the breach as unsophisticated, citing poor security practices at GSG. The group claimed the teacher/staff authentication database stored 12,303 passwords in plaintext, with 12,301 using the default password "giis123" a critical lapse in basic security controls. The lack of encryption, access restrictions, or detection mechanisms allowed attackers to extract data undetected. The incident raises concerns about the exposure of highly sensitive information, including private communications between parents and staff. While schools may not intentionally collect medical data, the breach revealed that such details were routinely stored in internal messages. Regulators and affected individuals are likely to scrutinize GSG’s security measures moving forward.