SCAD EDU Listed by avoslocker Ransomware Group

Savannah College of Art and Design was listed on the AvosLocker ransomware leak site on December 26, 2022. The private nonprofit art school, which enrolls more than 14,000 students worldwide, is claimed to have had internal files exfiltrated during a ransomware attack. The listing states that one database, a file list, and sample data including emails and phone numbers were posted, with a claim that everything would be leaked within two weeks if demands were not met. Anyone who has attended SCAD, worked there, or had family members enrolled may have personal information now at risk.

Primary Disclosure Details

The AvosLocker leak site listing, archived via ransomware.live, states that SCAD suffered a ransomware incident in which attackers exfiltrated internal files. The disclosure indicates that one database and file list were taken, and a sample published on the site contained email addresses and phone numbers. The notification does not quantify the total number of affected records, nor does it specify every type of data involved beyond the samples shown. The group gave the university a two-week window before full publication, a standard pressure tactic in their playbook. No official SCAD breach notification has altered these core facts from the primary leak-site posting.

Why This Matters for You and Your Family

If you or your children have ever applied to, attended, or worked at SCAD, your contact details may now sit in a publicly accessible ransomware repository. Emails and phone numbers exposed in such incidents routinely fuel phishing campaigns, robocalls, and identity-theft attempts that target families for years afterward. Students and parents often share the same household address and phone numbers in application forms, creating a single point of failure that can affect everyone living at that location. Even if the full volume of stolen data remains unknown, the confirmed sample leakage means the risk is not theoretical.

Doxxing and Identity-Chain Risks

Once email addresses and phone numbers appear on a ransomware site, they become building blocks for doxxing chains. Attackers or opportunistic criminals cross-reference them with gaming usernames, social-media handles, and school records to map entire households. A student’s leaked school email can link to a parent’s work address, a family phone plan, and children’s online gaming accounts. These connections allow persistent harassment, account takeovers, and targeted scams that follow families long after the initial breach fades from headlines. Credential leaks of this nature frequently cascade into gaming-platform compromises where children’s accounts become entry points for further identity exposure.

AvosLocker’s Known Track Record

Public reporting attributes AvosLocker’s emergence to mid-2021. The group has targeted organizations across education, healthcare, and manufacturing sectors, with prior victims including municipalities and private colleges. Their typical playbook begins with initial access gained through phishing or exploited remote desktop protocols, followed by exfiltration of internal files before encryption. They then list victims on their leak site and apply a two-week countdown to full data publication unless ransom is paid. The group’s extortion style relies on public pressure rather than solely on encryption, a pattern consistent with the SCAD listing.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real identity, with cleanup of exposed records.
• Rotate any password used at SCAD anywhere else it is reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same leaked contact details.
• Let remediation specialists handle takedown requests across data brokers and leak sites on your behalf.

The SCAD breach illustrates how even a single exposed database can create lasting exposure for thousands of families. Acting quickly on credential hygiene and identity mapping limits how far attackers can travel down the chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage that includes children’s gaming accounts. Source: https://www.ransomware.live/id/U0NBRCBFRFVAYXZvc2xvY2tlcg==