Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us
Logo

St Peters Anglican Primary School

stpeters.sa.edu.au
Group Thegentlemen
Discovered 2026-10-16 09:33 UTC
Est. attack date 2026-10-14
Country AU
Sector
Agriculture and Food Production Education Energy & Utilities Financial Services Government & Defense Healthcare Hospitality Manufacturing Other Professional Services Retail & E-Commerce Technology Transportation

Description:

stpeters.sa.edu.au St Peter's Anglican Grammar independent Anglican co-ed school in Campbelltown, NSW (est. 1983, revived parish school), teaching Pre-K to Year 6 (~428 students, ICSEA 1118 — 89th percentile nationally). It's part of the Campbelltown Anglican Schools Council (CASC) alongside Broughton Anglican College (P–12) and St Peter's Heart (special needs). Academics are solid: NAPLAN scores run ~33 points above the national average, SchoolRank rates it 69.3/100 ("Good", 129th in NSW), and it's one of only two IB PYP World Schools in the Macarthur region. Fees are modest — $9,400/yr (K–2) and $9,920/yr (Y3–6) — with generous sibling discounts up to 100%. Led by Principal Michelle McDonnell (2023–) under CEO Andrew Middleton; 39 teachers, 14.9:1 ratio, strong specialist programs (German, French, STEAM from K). The one major controversy: in July 2022 the council abruptly closed a just-launched high school (Years 7–12)
Infostealer activity detected by HudsonRock

Compromised Employees: 18

Compromised Users: 8

Third Party Employee Credentials: 25

External Attack Surface: 11

Exposure Report
by ParanoidLab
4450
Passwords
194 critical
10
Cookies
1 critical
Last queried 2026-10-16 09:33 UTC

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • No emails found.
MX Records
  • stpeters-sa-edu-au.mail.protection.outlook.com. Microsoft 365
TXT Records
  • nintex.6667eeb9fcd1d830db04f96c
  • amazonses:
  • 625bbad341954dd8b1f1c5f5ce507a14
  • 6GP0e0rjM+WjViINAqI4Rc+/2ofO/0Gojl8s56rrnSSqwtYqM3gsjQxGcRzDJgG+csj6E3avbUcdFHiPowyGAg==
  • autodesk-domain-verification=AtizZztGjmjlVB5GOXE9
  • MS=ms83628524
  • _242va5m05d4v8l3yd78peb0czvdlpu6
  • MS=66C912C6AA06FA18EE3F1DEDF66B7C128AFDB40A
  • v=spf1 mx a ip4:182.255.96.130 ip4:54.240.30.12 ip4:54.240.30.13 include:spf.protection.outlook.com include:oliverlibrary.com.au include:servers.mcsv.net include:amazonses.com -all
  • apple-domain-verification=2fXmV6sFqdfgCo3E
  • ZOOM_verify_wew_JYiOSfeK86bvVCcymQ
  • f1acfc00-8916-48b9-bed2-488eeff4db71-stpeters.sa.edu.au
Cloud / SaaS Services Detected
Amazon SES/WorkMail Apple Autodesk Mailchimp Microsoft 365 Zoom

Legal Disclaimer: Ransomware.live does not engage in the acquisition, exfiltration, downloading, possession, hosting, access, consultation, redistribution, or disclosure of unlawfully obtained data. This platform indexes only publicly visible information posted by ransomware operators and open web sources without accessing or obtaining the underlying stolen content. The service is provided to support public awareness, legitimate research, and cyber-resilience. No stolen personal or confidential data is collected or distributed via this site.