inthinking.net Listed by darkvault Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 20 November 2024, the educational technology firm inthinking.net appeared on a listing associated with the darkvault ransomware group. The group claims to have carried out a ransomware attack that involved the exfiltration of internal files. For teachers, school administrators, training participants and others who may have shared information with the company, the practical stakes are straightforward: any personal or professional details held in those files could now be outside the organisation’s control, raising the possibility of misuse even if the exact contents remain unconfirmed.

Public detail is limited. The number of people affected is unknown, and no independent confirmation of the claim has been reported. Still, a listing of this kind is enough to warrant attention from anyone connected to InThinking’s services, because ransomware groups typically threaten to publish stolen data if their demands are not met.

What happened

According to the available record, inthinking.net was listed by the darkvault ransomware group on 20 November 2024. The listing states that internal files were exfiltrated during a ransomware attack. No further technical details—such as the initial access method, the duration of the intrusion, the volume of data taken, or any ransom demand—have been disclosed in the public facts. The number of individuals whose information may be involved is also unknown. The incident is therefore known only through the group’s claim on its leak site; it has not been independently verified in the material provided.

The group behind it: darkvault

Darkvault is a ransomware operation that follows the now-common double-extortion model. Groups of this type typically gain access to a network, encrypt systems to disrupt operations, and simultaneously copy data so they can threaten to release it if payment is refused. Victims are often listed on dedicated leak sites as a form of pressure. Darkvault has been observed using this approach in other incidents, publishing sample files or full archives when negotiations stall. Its listings are claims made by the group itself; they do not constitute confirmed proof that every stated detail is accurate. In the present case, the only assertion on record is that internal files belonging to inthinking.net were taken. No additional statements by darkvault about this specific victim appear in the facts.

inthinking.net and its sector

InThinking describes itself as an educational technology and training company that supplies web-based resources and professional development for IB World Schools. With more than two decades of activity, it focuses on curriculum support and the promotion of critical thinking. Organisations of this kind sit at the intersection of education and digital services: they maintain platforms used by teachers and schools, store account information, training records, and sometimes curriculum materials or contact details for partner institutions. A breach involving such a provider can therefore touch multiple layers of the educational ecosystem—individual educators, school administrators, and the institutions that rely on the company’s tools. Because the sector handles both professional and, in some cases, student-related data, any unauthorised access carries consequences beyond a single company.

What data was at risk

The facts state only that internal files were exfiltrated. No inventory of specific data types—such as names, email addresses, passwords, financial records, or student information—has been disclosed. Organisations that deliver online training and curriculum resources typically hold staff and user account details, correspondence, course enrolment lists, and operational documents. Whether any of those categories were among the files taken remains unconfirmed. Readers should treat the precise contents as unknown until further information is released by the company or verified by independent investigators.

Why it matters

For individuals whose details may have been stored by InThinking, the primary risks are practical rather than dramatic. Exposed contact information can be used for targeted phishing. Login credentials, if present, could enable account takeover on other services that reuse the same password. Professional records might be leveraged for social-engineering attempts against schools or colleagues. For the organisation itself, the incident can disrupt day-to-day operations, damage trust among partner schools, and create regulatory or contractual obligations to notify affected parties. Because the scale remains unknown, the full extent of these effects cannot yet be measured, but even a limited set of internal files can generate lasting secondary harm once it leaves controlled systems.

If your data was in this claimed breach

If you have an account with InThinking, have attended its training, or have otherwise shared personal or professional information with the company, treat the listing as a prompt to act cautiously. Change any passwords that may have been used on its platforms, and enable multi-factor authentication wherever it is available. Monitor email and financial accounts for unexpected messages or activity. Be sceptical of unsolicited requests that reference your connection to the company. You can also run a free exposure scan of your email address to check whether that address has already appeared in known breach data sets; such a scan provides an additional, independent signal of whether your information has circulated more widely. If you later receive formal notification from InThinking, follow the guidance it supplies and keep records of any steps you take.

AICompiled with AI assistance from public sources and published under our editorial standards.