Liceo Francés Antoine y Consuelo de Saint-Exupéry Listed by thegentlemen Ransomware Group

On September 9, 2025, the French school Liceo Francés Antoine y Consuelo de Saint-Exupéry in El Salvador appeared on the leak site of the ransomware group known as thegentlemen. The attackers claim to have exfiltrated internal files from the institution, which serves families from kindergarten through high school and follows the French national curriculum.

Reported Details of the Incident

Public reporting indicates the school’s website, www.lfelsalvador.org, and its ZoomInfo business profile were listed alongside the announcement. The data exposed consists of internal files taken during a ransomware attack. The number of individuals whose information is contained in those files remains unknown. No specific samples of the stolen data have been publicly detailed beyond the group’s claim of successful exfiltration.

The incident follows the group’s typical pattern of posting victim organizations on its dark-web leak site after encryption and data theft. The listing appeared on an onion address hosted via ransomware.live, a site that aggregates ransomware activity.

Why This Matters for You and Your Family

Schools hold detailed records on children, parents, addresses, contact numbers, medical notes, and sometimes financial or immigration information. When those records are stolen, the risk extends far beyond the institution. Your family’s personal data can appear in follow-on sales or dumps that fuel identity theft, phishing, or physical threats.

Even if your child does not attend this specific school, similar breaches happen regularly at educational institutions worldwide. The information stolen in one incident often links to other accounts you or your children use, creating a chain that is difficult to see without deliberate checking.

The Doxxing and Identity-Chain Risks

Ransomware groups rarely stop at posting a single file dump. Once internal documents leave the victim’s control, they can be traded on underground forums, combined with other leaks, and used to map relationships between email addresses, usernames, phone numbers, and real-world identities. This process, known as identity chaining, turns one breach into multiple future attacks.

Credential leaks like this one cascade into account takeovers on gaming platforms, social media, and email. Children’s gaming accounts are especially vulnerable because kids often reuse simple passwords or personal details that appear in school records. A single exposed parent email can lead to a compromised Roblox or Minecraft account, which then reveals the child’s full name, age, and location to attackers.

Thegentlemen’s Publicly Known Track Record

Public reporting attributes thegentlemen with emerging in late 2024 as a ransomware operation that combines encryption with data theft and public shaming. The group has listed schools, healthcare providers, and small-to-medium businesses. Its playbook typically involves initial access through phishing or exploited remote desktop services, followed by exfiltration of sensitive files and deployment of ransomware. After a short negotiation window, the group publishes victim names and samples on its leak site to pressure payment. Exact success rates and prior victim counts are not independently verified, but the pattern of targeting organizations with limited cybersecurity resources is consistent across available reporting.

What to do

• Run a DoxxScan to map every link between your family’s emails, phone numbers, usernames, and real identities so you can break the chains before criminals exploit them.
• Rotate any passwords used at the school or similar educational portals anywhere else they are reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your household is caught in hours, not months.
• Cover the entire household with DoxxScan family protection, which extends to children’s gaming accounts that often chain back to the same addresses and parent emails exposed in school breaches.
• Let remediation specialists handle takedown requests across data brokers and leak sites so you do not have to negotiate directly with threat actors or spend weeks chasing removal links.

The speed with which ransomware groups move stolen data means families must act before their information spreads further. Starting with clear visibility into existing exposures and putting active protections in place limits the damage from this claimed breach and the ones that will inevitably follow. DoxxScan by GalaxyWarden delivers that visibility through continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts.