The cybercriminal group xpl0itrs claims to have compromised the infrastructure of Gruppo Spaggiari Parma, one of the main technology providers for the Italian educational system, and to have stolen 6.1 TB of data from more than 3,000 schools.
Hackmanac, a platform specialized in monitoring cyber threats, reported the alleged intrusion this past Thursday. According to the disseminated information, the supposedly exfiltrated data would include personal information of students and teachers, as well as medical data, identity information, and contact details.
For now, the attack has not been independently verified, and there is no public confirmation to support either the 6.1 TB volume or the categories of information that the attackers claim to have stolen.
Even so, the claim highlights an increasingly concerning issue that we have repeatedly addressed in Digital Shield: educational centers have become particularly attractive targets for cybercriminals due to the enormous amount of personal information they store and because many of these data can retain their value for years.
A single attack can affect thousands of schools
The potential scale of the incident is related to Spaggiari’s position within the Italian educational system. The company develops digital platforms and services that connect schools, teachers, students, and families. Among them is ClasseViva, an ecosystem used to manage different academic and administrative processes.
This concentration makes companies like Spaggiari especially attractive targets. Cybercriminals do not need to compromise thousands of schools individually if they manage to access the technology provider that serves them all.
It is one of the risks associated with the digitalization of education: the more services and data are concentrated on common platforms, the greater the impact of a single vulnerability can be.
Academic data is worth much more than just grades
The information stored by educational centers goes far beyond grades. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) notes that schools and their technology providers may also store assessment results, addresses, phone numbers, emails, special education information, disciplinary records, financial information, and medical data.
For cybercriminals, the value is not necessarily in each individual data point but in the possibility of cross-referencing different records to build detailed profiles of individuals.
A name associated with an email address may have limited value. That same name linked to a birth date, home address, family members, phone number, educational center, academic history, or medical information constitutes a much more powerful tool for phishing, social engineering, fraud, or identity theft.
And when the victim is a minor, an additional factor arises: the information can maintain its utility for many years.
The cybercriminal group xpl0itrs claims to have compromised the infrastructure of Gruppo Spaggiari Parma, one of the main technology providers for the Italian educational system, and to have stolen 6.1 TB of data from more than 3,000 schools.
Hackmanac, a platform specialized in monitoring cyber threats, reported the alleged intrusion this past Thursday. According to the disseminated information, the supposedly exfiltrated data would include personal information of students and teachers, as well as medical data, identity information, and contact details.
For now, the attack has not been independently verified, and there is no public confirmation to support either the 6.1 TB volume or the categories of information that the attackers claim to have stolen.
Even so, the claim highlights an increasingly concerning issue that we have repeatedly addressed in Digital Shield: educational centers have become particularly attractive targets for cybercriminals due to the enormous amount of personal information they store and because many of these data can retain their value for years.
A single attack can affect thousands of schools
The potential scale of the incident is related to Spaggiari’s position within the Italian educational system. The company develops digital platforms and services that connect schools, teachers, students, and families. Among them is ClasseViva, an ecosystem used to manage different academic and administrative processes.
This concentration makes companies like Spaggiari especially attractive targets. Cybercriminals do not need to compromise thousands of schools individually if they manage to access the technology provider that serves them all.
It is one of the risks associated with the digitalization of education: the more services and data are concentrated on common platforms, the greater the impact of a single vulnerability can be.
Academic data is worth much more than just grades
The information stored by educational centers goes far beyond grades. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) notes that schools and their technology providers may also store assessment results, addresses, phone numbers, emails, special education information, disciplinary records, financial information, and medical data.
For cybercriminals, the value is not necessarily in each individual data point but in the possibility of cross-referencing different records to build detailed profiles of individuals.
A name associated with an email address may have limited value. That same name linked to a birth date, home address, family members, phone number, educational center, academic history, or medical information constitutes a much more powerful tool for phishing, social engineering, fraud, or identity theft.
And when the victim is a minor, an additional factor arises: the information can maintain its utility for many years.
