Ransomware: qilin claims The Nueva School (US) — Education

A new ransomware incident has been publicly claimed by the Qilin group, targeting The Nueva School, a private educational institution in the United States. The claim was published on the ransomware.live data leak site on July 18, 2026, under the BREACH framework. This indicates that the threat actor has likely exfiltrated sensitive data and is threatening to release it unless a ransom is paid. While the breach is US-based, it serves as a critical reminder for EU compliance teams that ransomware groups continue to target the education sector, which often holds significant personal data on minors and staff.

The primary affected organizations are educational institutions, particularly private schools and universities, which may be seen as vulnerable due to limited cybersecurity budgets and high data sensitivity. However, any organization handling personal data under GDPR or other EU regulations should take note, as ransomware attacks frequently lead to data breaches that trigger mandatory notification obligations. The education sector is a recurring target because of the value of student and employee records.

Compliance teams should immediately review their incident response plans to ensure they include ransomware-specific procedures, particularly for data exfiltration scenarios. Verify that data backups are offline, immutable, and tested regularly. Assess whether your organization has adequate detection and response capabilities for ransomware groups like Qilin, which are known for double extortion tactics. Finally, confirm that your data breach notification process aligns with Article 33 of the GDPR, ensuring you can report to the relevant supervisory authority within 72 hours of becoming aware of a breach.