Skip to content
Leak-site post naming American Campus, captured by ThreatCluster

American Campus

helix

Ransomware leak-site victim intelligence

Posted
Oct 19, 2026
Country
US
Industry
Education

Summary

Written by ThreatClusterfrom file listing, victim profile, leak post

The leak claims to have taken data from American Campus, citing yearly revenue around $1 billion; data categories claimed include People, Customers, leads, accounts, employees, extra addresses, and cases, with sample filenames such as Leads, Properties, Collections, Answers, Unit revenue, Questionnaires, Charges, Signatures, Collection messages, Leases, Relationships, and Prices. The leak page identifies American Campus as the victim and lists GoFile as the platform; it states the publication status is published, with the countdown unlocked and downloads live. These are the group’s claims and are based on the leak site; no independent verification is provided here.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Platforms
GoFile

What was taken

Yearly revenue ~$1 billion yearly.

Data categories
PeopleCustomersleadsaccountsemployeesextra addressescases
Sample files (19)
Leads
Properties
Collections
Answers
Unit revenue
Questionnaires
Charges
Signatures
Collection messages
Leases
Relationships
Prices
Emails
Unit assets
Lease emails
Preferences
Product moves
Product
Payment schedules

Leak-site images (1)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture