The American School Foundation Listed by qilin Ransomware Group

On November 26, 2025, the American School Foundation appeared on the leak site operated by the qilin ransomware group. The group claims to have exfiltrated internal files from the Mexico City-based international school, which serves students from preschool through grade 12. Families whose children attend the school, along with current and former staff, now face the possibility that sensitive personal and financial records have been stolen and could be published or sold.

What Public Reporting Shows

Public reporting indicates the American School Foundation was listed on the qilin leak site with an accompanying claim that internal data had been taken. Available details describe the incident as a ransomware attack in which the attackers exfiltrated files before encrypting systems or demanding payment. The exact number of records involved remains unknown, and the specific types of data have not been publicly detailed beyond the broad description of internal files. No independent verification of the group’s claims has been released by the school as of the latest available information.

Why This Matters for You and Your Family

When a school is hit, the people most exposed are often the parents, students, and employees whose information is stored in administrative systems. Names, addresses, dates of birth, contact details, and financial records tied to tuition payments or scholarships can appear in stolen files. Once that information reaches dark-web markets or public leak sites, it can be used for identity theft, phishing campaigns, or harassment. Your family does not need to be high-profile for the data to be valuable; attackers routinely target ordinary households because the information is easy to monetize. Children’s records are especially attractive because they often remain unchanged for years and can be paired with parental data to build long-term profiles.

The Doxxing and Identity-Chain Implications

A single breach rarely stays isolated. Credential leaks from school portals frequently cascade into gaming accounts, email, and social-media profiles. Attackers use automated tools to link an email address found in one breach to usernames on Roblox, Discord, Minecraft, or other platforms your children use. This creates an identity chain that can lead to doxxing, account takeovers, or extortion attempts. Public reporting on similar incidents shows that gaming credentials exposed in school breaches have been used to seize accounts, demand ransoms from children, or harass families. The chain can also connect back to home addresses listed in enrollment forms, exposing physical locations.

Qilin’s Publicly Known Track Record

Public reporting attributes the qilin ransomware group with emerging in 2022. The group has targeted hospitals, schools, municipalities, and private businesses across multiple countries. Notable prior victims include healthcare providers and educational institutions where sensitive personal data was at stake. Qilin’s typical playbook involves initial access through phishing or exploited remote desktop services, followed by exfiltration of internal documents, and then publication on their leak site if ransom demands are not met. The group often sets short deadlines for payment before releasing samples or the full dataset. Their extortion style combines data publication threats with direct pressure on victims to prevent reputational damage.

What to do

• Run a DoxxScan to map every link between your family’s emails, phone numbers, usernames, and real-world identities so you can see exactly what chains exist right now.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your household is caught and acted on within hours rather than months.
• Rotate any password used at the American School Foundation anywhere else it is reused, and switch to 2FA through an authenticator app instead of text messages.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often become the next link in doxxing chains after school data leaks.
• Let remediation specialists handle takedown requests for any exposed personal information appearing on data-broker or leak sites.

The incident at the American School Foundation is a reminder that ransomware groups continue to view educational institutions as rich targets for personal data. Acting quickly on the information that has already leaked, and putting persistent monitoring and cleanup in place, reduces the chance that this claimed breach becomes the first step in a longer campaign against your family. DoxxScan by GalaxyWarden delivers that combination of continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and household coverage that includes children’s gaming accounts.