Unified Assessment Platform ExamRoom.AI Listed by Crypto24 Ransomware Group

On December 23, 2025, the crypto24 ransomware group added Unified Assessment Platform ExamRoom.AI to its leak site, claiming that internal files had been exfiltrated from the online proctoring and assessment service.

What Public Reporting Shows

Public reporting indicates the company suffered a ransomware intrusion in which attackers gained access to internal systems and removed sensitive files. The victim count remains unknown, but the platform serves educational institutions, testing centers, and professional certification bodies that handle large volumes of student and candidate data. Available reporting describes the exposed material as internal files; exact contents have not been independently verified by third parties. The listing appeared on the crypto24 leak site, which is tracked by ransomware.live. No evidence has surfaced that the attackers have begun selling the data on additional forums.

Why This Matters for You and Your Family

If you or your children have taken an online exam, certification test, or remote proctored assessment in the past few years, your information may have been inside the compromised systems. ExamRoom.AI processes names, email addresses, phone numbers, government-issued ID scans, webcam footage, keystroke patterns, and sometimes home addresses for identity verification. A breach of this scale can give criminals the raw material they need to impersonate family members, open accounts, or launch convincing phishing campaigns. Because education-related services often share infrastructure with other household logins, one leak can quietly ripple into banking, tax, and social-media accounts.

The Doxxing and Identity-Chain Implications

Ransomware operators rarely stop at the first dataset. Once internal files leave the victim’s network, they are catalogued, cross-referenced, and fed into automated doxxing pipelines. A student’s email and phone number harvested from ExamRoom.AI can be linked to a parent’s credit report, a family member’s gaming username, or a shared home address. These identity chains grow quickly: one exposed credential becomes a foothold for account takeover, which yields more documents, which are then sold or published to pressure payment. Gaming accounts belonging to children are especially vulnerable because they frequently reuse passwords or recovery emails tied to the same family identity. Continuous monitoring across large breach repositories is one of the few practical ways to detect these expanding chains before they reach public leak sites.