ZS Salovnova Listed by The Gentlemen Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Parents, staff and former pupils connected to ZŠ Šalounova may now face uncertainty about whether personal information held by the school has been copied or exposed. On 7 August 2026 the institution appeared on a leak site operated by the ransomware group known as The Gentlemen; the number of people affected and the precise categories of data remain undisclosed, leaving those linked to the school without clear confirmation of what, if anything, has left its systems.

Until more detail emerges, the practical stakes centre on the kinds of records a primary school routinely keeps—contact details, academic and counselling notes, and administrative files—and on the possibility that such material could be misused for fraud, social engineering or unwanted contact.

Inside the incident

Public reporting states that ZS Salovnova, operating as ZŠ Šalounova, was listed by The Gentlemen ransomware group on 7 August 2026. The listing itself is a claim published by the group; independent confirmation of a successful intrusion, the method used, or any ransom demand has not been supplied in the available record. The number of people affected is unknown, and no inventory of files or data types has been released. Timing beyond the reported listing date, the scale of any exfiltration, and technical indicators of compromise are likewise undisclosed.

In short, the only firmly established public fact is the appearance of the school’s name on the group’s leak site. Everything else about the incident remains unconfirmed.

The group behind it: The Gentlemen

The Gentlemen is a ransomware operation that has appeared in public reporting as a double-extortion actor: after encrypting systems it typically claims to have stolen data and threatens to publish or sell that data unless a payment is made. Like other groups in this category, it maintains a leak site on which it names alleged victims and, in some cases, posts sample files to pressure organisations. Its tactics generally include initial access through compromised credentials or vulnerable remote services, lateral movement, data theft, and deployment of ransomware—though the precise playbook used against any single target is rarely confirmed until forensic reports appear.

With respect to ZS Salovnova, the sole public assertion is the group’s own listing. No statement from The Gentlemen detailing what it allegedly took from this school, nor any independent verification of those claims, is contained in the available facts. Readers should therefore treat the listing as an unverified claim rather than established proof of compromise.

ZS Salovnova and its sector

ZŠ Šalounova is a primary school in the Vítkovice district of Ostrava, Czech Republic. It operates across two buildings on Šalounova and Halasova streets and provides standard primary education together with specialised programmes, extracurricular clubs, and a full school counselling service staffed by psychologists, special educators and career counsellors. It also runs educational and sports projects intended to support pupil development.

Schools of this type sit at the intersection of education and child welfare. They necessarily hold records on minors, their families, and staff. A breach affecting such an institution is consequential because the data often include identifiers and contact information that remain useful to criminals for years, and because the subjects—children and parents—may have limited ability to monitor or remediate misuse. The sector as a whole has become a recurring target for ransomware groups precisely because operational disruption is highly visible and because the sensitivity of pupil data raises the stakes of any leak.

What data was at risk

The facts do not name any specific data types as exposed; the contents of any alleged theft remain undisclosed and unconfirmed. Organisations of this kind typically maintain pupil enrolment and attendance records, parent or guardian contact details, health or special-needs notes, counselling files, staff personnel information, and administrative documents. Whether any of those categories were copied in this incident is unknown. Until a verified inventory is published, no concrete claim can be made about what left the school’s systems.

The real-world impact

For individuals, the main risks are secondary misuse: phishing or social-engineering attempts that reference genuine school details, identity fraud that exploits names and dates of birth, or unwanted contact directed at families. Because many of the potential subjects are minors, the longer-term exposure of counselling or special-education notes could also carry privacy and reputational consequences if such material ever surfaces. For the school itself, the listing creates operational and reputational pressure—possible system downtime, the cost of investigation and recovery, and the need to communicate with parents and authorities—regardless of whether a full data leak ultimately materialises.

None of these outcomes is confirmed; they are the ordinary consequences that follow when a school is named by a ransomware group and the scope of exposure stays unclear.

What to do if you're exposed

If you have a past or present connection to ZŠ Šalounova—as a parent, pupil or staff member—consider the following practical steps while official details remain limited:

• Treat unsolicited messages that mention the school or your child’s enrolment with caution; verify any request for personal data through official school channels.
• Monitor bank and official accounts for unusual activity and enable multi-factor authentication wherever it is offered.
• If you receive notification from the school or Czech authorities, follow their guidance on credit monitoring or document replacement.
• Change passwords for any accounts that may have shared credentials with school-related services.
• Run a free exposure scan of your email addresses to check whether they have already appeared in known breach data sets.

Public information about this incident is still sparse. Staying alert to official updates from the school and relevant Czech data-protection bodies remains the most reliable way to learn whether your information was involved and what further steps, if any, are recommended.

AICompiled with AI assistance from public sources and published under our editorial standards.