Skip to content
Ransomware Attack on WA School by ThreeAM Group

Ransomware Attack on WA School by ThreeAM Group

First seen 1 Oct 2026, 10:02 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 1, 2026 at 10:59 UTC
  • •St James' Anglican School experienced a ransomware attack affecting personal data.
  • •ThreeAM ransomware group claimed responsibility but has not yet published any data.
  • •The school is conducting a cyber security audit and has notified affected families.

St James’ Anglican School in Alkimos, WA, reported a cyber security incident on September 14, 2026, involving unauthorized access to its computer systems. The school confirmed that personal information of community members may be affected and has notified families about the breach. On September 28, the ThreeAM ransomware group claimed responsibility for the attack via its darknet site, threatening to publish the stolen data. However, the school stated that no evidence of data publication had been found so far. A thorough cyber security audit is underway, and the Australian Cyber Security Centre and the Office of the Australian Information Commissioner have been notified. Teaching at the school has continued without disruption. The ThreeAM group has previously targeted 99 victims across 22 countries since its emergence in August 2023.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-09-14
Initial breach disclosure
St James’ Anglican School reported unauthorized access to its computer systems and began an investigation.
Insurancebusinessmag
2026-09-28
ThreeAM claims responsibility
The ThreeAM ransomware group claimed the attack on its darknet site, stating that files would be available soon.
Cyberdaily.Au

More articles in this cluster (2)

Following this threat?

Track Threeam and ANU Enterprise in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (7)

1 / 3

Common questions

What data was compromised?
The school confirmed that personal information relating to members of the school community was involved.
Is the data published yet?
No evidence has been found that any information from the school's systems has been published online.
What steps is the school taking?
The school is conducting a thorough cyber security audit and has notified families about the incident.