BeLi Teacher / FSC education centers (AWS) Listed by N0n Ransomware Group

The N0n ransomware group has listed BeLi Teacher and FSC education centers on its leak site, claiming it holds the complete CRM lead database of 152,044 contact records along with a migrated CRM file archive. The group says it will publish the material in batches if no settlement is reached. As of writing, neither BeLi Teacher nor FSC education centers has publicly confirmed any incident.

This means the organisation has been named in an unverified extortion listing. The record provides no proof that any data was actually taken, and it does not disclose how the group obtained the claimed material, if at all. For you as someone who may have interacted with these Vietnamese education centres, the immediate question is whether any of your information is genuinely at risk and what that risk actually looks like.

Your Information Is Not Automatically Public

The listing claims names, emails, Vietnamese phone numbers, cities, study interests, and engagement history from the CRM system, plus tasks, forums, comments and customer files. However, these are the attackers’ own words, not an audited inventory.

What a Leak-Site Listing Actually Establishes

Ransomware and extortion groups frequently post organisations on leak sites to create pressure. The listing itself is marketing material designed to frighten both the target and its customers. Many such postings turn out to be recycled data from older incidents, exaggerated claims, or cases where the group never obtained the volume or sensitivity of information they advertise.

Real confirmation would require the company to issue a formal statement, regulators to acknowledge the incident, or direct notification to affected individuals. None of those have occurred here. The September 18, 2026 filing date tells us only when the group chose to list the organisation, not when or whether any compromise took place. Until independent evidence appears, this remains an accusation, not an established breach.

The Education Sector Pattern N0n Is Following

Groups targeting Vietnamese edtech and language centres have repeatedly used leak-site pressure tactics. The pattern often mixes genuine compromises with inflated or reused databases to force payment. Claiming an entire CRM lead list of over 152,000 records is common in these campaigns because the volume sounds alarming even when the actual risk to any single person is modest.

Knowing this pattern helps you calibrate your concern with the next similar listing you see. The presence of a leak-site post should prompt basic account hygiene but does not, by itself, mean your full personal history is circulating on criminal forums.

What You Can Still Control

Even if some of your contact details were included, you retain practical leverage. Most of the claimed data consists of information you can monitor and partially neutralise.

• Watch for unexpected login attempts or password-reset emails from any service where you reuse elements of your BeLi contact information.
• Be wary of phishing attempts that reference your study interests or past engagement with these centres. Attackers sometimes use such details to make fraudulent messages appear legitimate.
• Review recent bank and email statements for any charges or sign-ups you do not recognise. Early detection limits damage from any downstream identity misuse.

Absence of a direct notification letter from the organisation usually indicates your records were not part of any affected group, though anyone who has changed address since the claimed events should contact BeLi Teacher or FSC directly to confirm their status.

GalaxyWarden provides continuous monitoring across 13.1 billion breach records and more than 100 platforms, with identity-chain mapping and specialist remediation support.