Rectory School Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to list educational institutions on leak sites as part of double-extortion campaigns, a pattern that has become common across the current threat landscape. Schools and similar organisations often hold sensitive personal and operational records, making them attractive targets even when the full scale of an incident remains unclear.

On 9 September 2025, Rectory School was listed by the qilin ransomware group. Public detail is limited: the number of people affected is unknown, and the only data type described is internal files said to have been exfiltrated. The listing itself is a claim by the group rather than an independently confirmed event, yet it still warrants attention for anyone connected to the school.

What happened

According to available reporting, Rectory School appeared on a qilin leak site on 9 September 2025. The group claims that internal files were exfiltrated in a ransomware attack. No further public detail has been provided on the precise timing of the intrusion, the method of access, the volume of data taken, or whether systems were encrypted. The number of individuals potentially affected remains unknown. The group’s own listing text describes the school as a U.S. institution founded in 1920 and includes critical commentary, but that text constitutes the actor’s claim rather than verified fact.

Who is qilin?

Qilin is a ransomware-as-a-service operation that has been active for several years. Like many contemporary groups, it typically combines data theft with encryption threats, posting victim names on dedicated leak sites to pressure payment. Public reporting has linked qilin to attacks across multiple sectors, including education, healthcare and manufacturing, often using standard initial-access techniques such as compromised credentials or vulnerable remote services. The group is known for negotiating with victims and for releasing sample files when demands are not met. In this case, the only specific assertion tied to Rectory School is the leak-site listing itself; no additional claims by qilin about this particular victim have been independently verified in the available record.

About Rectory School

Rectory School is a private educational institution in the United States. Public historical information indicates it was founded in 1920 by Reverend Frank H. Bigelow. Schools of this type routinely maintain records on students, families, staff and donors, as well as internal administrative and financial documents. A ransomware listing involving such an organisation is consequential because educational settings handle data that can affect minors and their guardians, and because disruption of school systems can interrupt learning and administrative functions. The group’s listing characterises the school’s evolution in critical terms, but that characterisation remains the actor’s unverified statement.

The information in question

The only data type named in public reporting is “internal files exfiltrated in a ransomware attack.” Exact contents, file counts and categories have not been disclosed. Organisations of this kind typically hold student enrolment and academic records, parent or guardian contact details, staff personnel files, financial and donor information, and operational documents. Whether any of those categories were among the files claimed by qilin is unconfirmed. Because the number of people affected is also unknown, it is not possible to state the breadth of exposure with certainty.

Why it matters

If internal files were taken, individuals connected to the school—students, parents, alumni, faculty or staff—could face risks such as identity theft, phishing that leverages personal details, or unwanted contact. For the organisation itself, the incident raises operational, reputational and regulatory considerations common to educational institutions that handle personal data. Even when the precise contents remain undisclosed, the mere listing can create uncertainty and require careful communication with the school community. No public information establishes negligence on the part of Rectory School; the facts simply record the claim of exfiltration and the listing date.

Were you affected?

If you have a past or present connection to Rectory School, consider these practical steps:

• Monitor financial and email accounts for unusual activity and enable multi-factor authentication where available.
• Be cautious of unsolicited messages that reference the school or request personal information.
• Request information directly from the school about any official notifications or support it may offer.
• Place a fraud alert with credit bureaus if you believe sensitive identifiers may have been involved.
• Run a free exposure scan of your email address to check whether it has appeared in known breach data sets.

Public detail on this incident remains limited. Further confirmation of scope or contents would need to come from the school or from independent verification beyond the group’s claim.

AICompiled with AI assistance from public sources and published under our editorial standards.