Lead Company schools hit by ransomware data theft
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Ransomware gang exfiltrated student PII, parent contact data, and academic records from Indian school network.
A ransomware operator has claimed to have stolen approximately 766 MB of data from Lead Company, a school platform operating multiple Indian educational institutions. The exfiltrated dataset includes personally identifiable information on enrolled students across five named schools: Arya Vidyapith, Aakarsh International Public School, Students High School, Rainbow International Matric Hr. Sec. School, and Vignan Private School.
The compromised data encompasses multiple categories of sensitive records: student PII including full names, dates of birth, residential addresses with postal codes, and grade/class assignments; parent and guardian contact information including full names, mobile phone numbers, and email addresses; and proprietary academic metrics and classroom analytics from the LEAD school platform, including curriculum tier classifications and lesson plans. The breach appears to have involved access to the nucleus.leadschool.in administrative portal.
This represents a significant data protection incident affecting minors and their families at scale. The exposure of student dates of birth, home addresses, and parent mobile numbers creates severe risks for targeted phishing, voice-phishing, identity theft, and physical targeting. Defenders and incident responders should treat this as a credential compromise and unauthorized access incident requiring investigation of administrative portal access logs, user authentication, and data exfiltration paths.
Mentioned in this report
Detection guidance
1 detection for this report is in the app — rules that match its indicators, converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, plus YARA and Suricata. Three days of it free, no card.
Source reporting: https://www.ransomware.live/id/TGVhZCBDb21wYW55IChMZWFkZXJzaGlwIEJvdWxldmFyZClAc2hhZG93Ynl0MyQ=
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs