Cybercriminals Target Antwerp School, Shift Extortion to Parents After Ransom Demand Fails
In January, cybercriminals breached the internal networks of OLV Pulhof, a secondary school in Antwerp, Belgium, shortly after the Christmas break. The attackers, identifying themselves as "Lock-Bit" in an extortion email, claimed to have stolen sensitive data, including financial records and confidential mental health information on students and staff.
However, discrepancies in the group’s tactics such as the misspelled name and reliance on email rather than LockBit’s typical ransom notes suggest the threat actors may be impersonating the notorious ransomware gang. The initial demand of €15,000 ($17,800) was unusually low for LockBit, which typically targets larger payouts.
When the school refused to pay, the attackers pivoted to extorting parents, threatening to leak or sell the children’s data unless they received €50 per child. The school, following cybersecurity best practices, advised parents against engaging with the demands.
An investigation by the Antwerp public prosecutor’s office is ongoing, though no further details have been disclosed. The incident highlights an unusual shift in ransomware tactics, as targeting individuals for small payments is inefficient compared to traditional corporate extortion suggesting the attackers may be struggling to monetize their access.
Source: https://therecord.media/hackers-attempt-to-extort-parents-after-school-refuses-ransom-demand
OLV Pulhof cybersecurity rating report: https://www.rankiteo.com/company/olv-pulhof
"id": "OLV1770043662",
"linkid": "olv-pulhof",
"type": "Ransomware",
"date": "1/2026",
"severity": "100",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': 'Students and staff',
'industry': 'Education',
'location': 'Antwerp, Belgium',
'name': 'OLV Pulhof',
'type': 'Secondary school'}],
'customer_advisories': "Advised parents against engaging with the attackers' "
'demands',
'data_breach': {'data_exfiltration': 'Yes',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Financial records',
'Confidential mental health '
'information']},
'date_detected': '2024-01',
'description': 'In January, cybercriminals breached the internal networks of '
'OLV Pulhof, a secondary school in Antwerp, Belgium, shortly '
'after the Christmas break. The attackers, identifying '
"themselves as 'Lock-Bit' in an extortion email, claimed to "
'have stolen sensitive data, including financial records and '
'confidential mental health information on students and staff. '
'When the school refused to pay the initial ransom demand of '
'€15,000 ($17,800), the attackers pivoted to extorting '
'parents, threatening to leak or sell the children’s data '
'unless they received €50 per child.',
'impact': {'brand_reputation_impact': 'Potential reputational damage',
'data_compromised': 'Financial records, confidential mental health '
'information on students and staff',
'identity_theft_risk': 'High',
'systems_affected': 'Internal networks'},
'initial_access_broker': {'data_sold_on_dark_web': 'Threatened'},
'investigation_status': 'Ongoing',
'lessons_learned': 'Highlights an unusual shift in ransomware tactics, '
'targeting individuals for small payments instead of '
'traditional corporate extortion, suggesting attackers may '
'be struggling to monetize their access.',
'motivation': 'Financial gain',
'ransomware': {'data_exfiltration': 'Yes',
'ransom_demanded': '€15,000 ($17,800)',
'ransom_paid': 'No',
'ransomware_strain': 'LockBit (suspected impersonation)'},
'recommendations': 'Follow cybersecurity best practices, avoid engaging with '
'ransom demands, and report incidents to law enforcement.',
'references': [{'source': 'Cyber Incident Description'}],
'response': {'communication_strategy': 'Advised parents against engaging with '
'the demands',
'incident_response_plan_activated': 'Yes',
'law_enforcement_notified': 'Yes (Antwerp public prosecutor’s '
'office)'},
'threat_actor': 'Lock-Bit (suspected impersonation)',
'title': 'Cybercriminals Target Antwerp School, Shift Extortion to Parents '
'After Ransom Demand Fails',
'type': 'Ransomware'}