Unified Assessment Platform ExamRoom.AI Listed by crypto24 Ransomware Group

On December 23, 2025, the crypto24 ransomware group added Unified Assessment Platform ExamRoom.AI to its leak site, claiming that internal files had been exfiltrated from the online proctoring and assessment service.

What's Publicly Reported from Reporting

Public reporting indicates the company suffered a ransomware intrusion in which attackers gained access to internal systems and removed sensitive files. The victim count remains unknown, but the platform serves educational institutions, testing centers, and professional certification bodies that handle large volumes of student and candidate data. Available reporting describes the exposed material as internal files; exact contents have not been independently verified by third parties. The listing appeared on the crypto24 leak site, which is tracked by ransomware.live. No evidence has surfaced that the attackers have begun selling the data on additional forums.

Why This Matters for You and Your Family

If you or your children have taken an online exam, certification test, or remote proctored assessment in the past few years, your information may have been inside the compromised systems. ExamRoom.AI processes names, email addresses, phone numbers, government-issued ID scans, webcam footage, keystroke patterns, and sometimes home addresses for identity verification. A breach of this scale can give criminals the raw material they need to impersonate family members, open accounts, or launch convincing phishing campaigns. Because education-related services often share infrastructure with other household logins, one leak can quietly ripple into banking, tax, and social-media accounts.

The Doxxing and Identity-Chain Implications

Ransomware operators rarely stop at the first dataset. Once internal files leave the victim’s network, they are catalogued, cross-referenced, and fed into automated doxxing pipelines. A student’s email and phone number harvested from ExamRoom.AI can be linked to a parent’s credit report, a family member’s gaming username, or a shared home address. These identity chains grow quickly: one exposed credential becomes a foothold for account takeover, which yields more documents, which are then sold or published to pressure payment. Gaming accounts belonging to children are especially vulnerable because they frequently reuse passwords or recovery emails tied to the same family identity. Continuous monitoring across large breach repositories is one of the few practical ways to detect these expanding chains before they reach public leak sites.

What to Do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what this claimed breach connects to.
• Rotate any password you ever used on ExamRoom.AI or related assessment platforms, then enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is flagged within hours instead of months.
• Cover the entire household with DoxxScan family protection, which includes children’s gaming accounts that often chain back to the same addresses and recovery emails.
• Let remediation specialists handle data-broker takedown requests and follow-up notifications on your behalf while you focus on securing day-to-day accounts.

The incident is a reminder that data collected for legitimate academic and professional verification can become ammunition for extortion and identity theft years after it is first entered. Starting with a clear map of your family’s digital footprint gives you the best chance of breaking those chains before criminals exploit them. DoxxScan by GalaxyWarden delivers that visibility through continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that explicitly protects children’s gaming accounts.