Liceo Francés Antoine y Consuelo de Saint-Exupéry Listed by thegentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Families, students and staff connected to Liceo Francés Antoine y Consuelo de Saint-Exupéry face a practical concern: a ransomware group has publicly claimed that internal files from the school were taken during an attack. When a school’s systems are involved, the information at stake can include personal details that affect everyday life—identity, contact data, academic records—yet the precise scope remains limited in public reporting. Knowing what has been claimed, and what has not been confirmed, helps people decide what steps to take next.

On 9 September 2025 the organisation was listed by the ransomware group known as thegentlemen. Public detail on the number of people affected is unknown, and the only description of the material is that internal files were allegedly exfiltrated. This article sets out the known facts, places them in context, and outlines sensible precautions without speculation.

What happened

According to the available record, Liceo Francés Antoine y Consuelo de Saint-Exupéry was listed by thegentlemen ransomware group on 9 September 2025. The listing asserts that internal files were exfiltrated in a ransomware attack. No further public confirmation of the method of intrusion, the exact date of the intrusion itself, the volume of data, or any ransom demand has been supplied in the facts. The number of people whose information may be involved is recorded as unknown. The claim rests on the group’s leak-site listing; independent verification of the full contents or of successful decryption or restoration has not been detailed in the public summary.

Who is thegentlemen?

thegentlemen is a ransomware operation that has appeared in public reporting as a group that encrypts systems and simultaneously steals data, then threatens to publish the stolen material if payment is not made—a pattern commonly called double extortion. Like other contemporary ransomware actors, it typically advertises victims on dedicated leak sites to increase pressure. Public knowledge of the group’s broader activity includes listings of organisations across multiple sectors; however, any specific statements the group may have made about this particular school beyond the simple listing itself are not part of the What's Publicly Reported and are therefore treated only as the group’s claim. Attribution of the incident to thegentlemen therefore rests on that listing rather than on independently verified forensic findings released in the record.

Who is Liceo Francés Antoine y Consuelo de Saint-Exupéry?

Liceo Francés Antoine y Consuelo de Saint-Exupéry is a French school located in El Salvador. It forms part of the network of the Agency for French Education Abroad (AEFE) and educates pupils from kindergarten through the final year of secondary school. The school follows the curriculum set by the French Ministry of National Education; in addition to Salvadoran diplomas, students sit French examinations such as the brevet de collège and the baccalauréat. Its public web presence is associated with the domain lfelsalvador.org. Schools of this type routinely process and store personal data belonging to minors, parents, teachers and administrative staff—enrolment records, contact details, academic files, health or dietary information, and financial or fee-related documents. A breach affecting such an institution therefore carries consequences that extend beyond the organisation itself to the families and children whose information is held in its systems.

What data was at risk

The facts state only that internal files were exfiltrated in a ransomware attack. No inventory of specific data categories—such as names, addresses, identity numbers, grades, medical notes or payment details—has been disclosed. Organisations of this kind typically hold precisely those categories of information: student and parent contact data, academic transcripts, administrative correspondence, and sometimes health or financial records required for school operations. Because the exact contents remain unconfirmed, it is not possible to state which of those typical holdings were among the files taken. The public record therefore leaves the precise nature and sensitivity of the exposed material unknown.

Why it matters

For individuals, the practical risk is that personal information, once outside the school’s control, can be used for identity misuse, targeted phishing, or social-engineering attempts that reference genuine school details. Parents and older students may receive convincing fraudulent messages that appear to come from the institution. For the school itself, the incident can disrupt operations, require costly recovery and notification efforts, and erode trust among families who entrust sensitive data about minors to the establishment. Because the number of people affected is unknown and the file contents are not itemised, the full scale of residual risk cannot yet be measured; the absence of that detail itself prolongs uncertainty for those who may be involved.

What to do if you're exposed

If you or your family have a connection to the school, treat any unexpected messages that reference school matters with caution and verify them through official channels rather than links or attachments in the message itself. Monitor financial and identity accounts for unusual activity and consider placing fraud alerts with relevant credit or identity services where available in your jurisdiction. Change passwords on accounts that may have been used in school-related systems, and enable multi-factor authentication wherever it is offered. Because public detail on the exact data is limited, a free exposure scan of your email address can help you check whether that address has already appeared in known breach datasets; such a check is a practical first step while further official information, if any, becomes available.

AICompiled with AI assistance from public sources and published under our editorial standards.