Exclusive: WA's St James' Anglican School investigating cyber incident in wake of ...

ThreeAM cyber extortion group claims hack, threatens to publish data; the school has already contacted parents and families.

A West Australian school is responding to a recent cyber security incident and monitoring the dark web for the publication of data after a ransomware operator claimed responsibility for the attack.

St James’ Anglican School in Alkimos initially disclosed it was responding to an incident on 14 September , saying it had “recently identified a cyber security incident involving unauthorised access to its computer systems”.

“St James’ Anglican School recently identified a cyber security incident involving unauthorised access to its computer systems,” the school said.

According to the disclosure, the incident was contained, and St James is conducting a “thorough cyber security audit”.

Unfortunately, the school’s investigation uncovered that “personal information relating to members of the school community was involved”.

“The school has notified families and provided them with information the incident and practical steps they can take to protect their information,” it said.

The incident has now escalated, however, with the ThreeAM ransomware group claiming responsibility for the hack in a 28 September post to its darknet leak site. The group has not shared any further data, nor any other details to back its claim, but has said that “the files will be available soon”.

St James’ Anglican School is aware of the hackers’ claims.

“We have now been made aware a claim online relating to our school. At this stage, our experts have not identified any evidence that any information from our systems has been published or released online,” a school spokesperson told Cyber Daily.

“We are continuing to work with our independent cyber security to investigate the incident, including to continue to monitor for any publication of data.”

St James added that learning at the school has not been disrupted and that teaching continues.

“If our investigation identifies that any individual’s personal information has been affected, we will write to them directly and provide further specific guidance and steps they can take to protect themselves,” the school said.

The Australian Cyber Security Centre and the Office of the Australian Information Commissioner were informed when St James first learnt of the incident.

“We deeply regret any concern this incident has caused and will continue to do everything we can to support anyone affected in our school community,” the school said.

First observed in August 2023, ThreeAM is hardly one of the most active groups in existence and has only claimed 99 victims across 22 countries, including in Australia.

In 2025, cyber security company Sophos responded to a ThreeAM ransomware attack, which it outlined in a blog post at the time.

“In this case, the attacker used a phone call that spoofed the phone number of the organisation’s IT department,” Sophos said.

“The attack included deployment of a virtual machine to a compromised computer, providing the attackers with an initial foothold hidden from the view of endpoint protection software. The ransomware attack itself was thwarted, but the attackers were able to stay on the network for nine days before attempting to launch ransomware. They succeeded in stealing data from the targeted organisation’s network.”

Sophos said that ThreeAM had gathered information on its victim prior to the attack, including employee details.

“They used this information to tailor their attack,” it said.

The group’s last Australian victim was ANU Enterprise, which confirmed it was the victim of a ransomware attack in November 2024.

Who is St James’ Anglican School?

Based in the outer Perth suburb of Alkimos, St James’ Anglican School has more than 1,100 students across its junior and senior schools, which cater to students from kindergarten to Year 12.

The school celebrated its 10th anniversary in 2025.

David Hollingworth has been writing technology for over 20 years, and has worked for a range of print and online titles in his career. He is enjoying getting to grips with cyber security, especially when it lets him talk Lego.