Driving School Software Listed by PrinzEugen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware operations targeting organizations that manage personal and financial records remain a persistent feature of the threat landscape. On June 28, 2026, the PrinzEugen group listed Driving School Software on its leak site, stating that internal files had been taken during a ransomware attack. The listing indicates that hundreds of driving schools were affected, though the total number of individuals whose information may be involved remains unknown.

What happened

The incident centers on a ransomware attack against Driving School Software. The group claims to have exfiltrated internal files and made a full leak post and associated data available on its site. Reported details include 16 million rows of SQL data and 8,000 full credit card records among the material. No confirmed timeline for the initial intrusion or the precise method of access has been disclosed. The number of people directly affected is listed as unknown.

The group behind it: PrinzEugen

PrinzEugen is a ransomware actor that maintains a leak site to publish data obtained from targeted organizations. Public reporting on the group describes a pattern of encrypting systems and then threatening to release stolen files if ransom demands are not met. The current listing of Driving School Software constitutes the group's claim of involvement; independent confirmation of the data's authenticity or completeness has not been established in available reporting.

Driving School Software and its sector

Driving School Software supplies management systems to driving schools. Organizations in this sector routinely process learner records, scheduling information, payment details, and identification documents required for licensing and training. A compromise at a provider serving hundreds of schools can therefore concentrate data from many separate entities in one location, increasing the potential scope of any exposure.

What was likely exposed

The listing states that internal files were exfiltrated. Specific items referenced in the claim include 16 million rows of SQL data and 8,000 full credit card records. The exact contents of the files have not been independently verified.

• 16 million rows of SQL data
• 8,000 full credit card records
• Additional unspecified internal files

What's at stake

Individuals connected to the affected driving schools may face risks associated with the exposure of personal identifiers and payment information, including potential misuse for fraud or identity-related activity. For the organization and the schools it serves, the incident raises questions about data handling practices and the need to review access controls and incident response procedures. Long-term consequences depend on the nature of the data and how it is used after publication.

Were you affected?

Individuals can begin by monitoring bank and credit card statements for unauthorized activity and placing fraud alerts with major credit bureaus if they have provided payment details to any driving school using the affected software. Checking email addresses against known breach repositories offers one way to determine whether personal information has appeared in public data sets. Organizations should review any communications received from Driving School Software regarding the incident.

AICompiled with AI assistance from public sources and published under our editorial standards.