[FulcrumSec]

The Global Schools / GIIS / GSG Leaks

33,088 passport numbers belonging to children and their parents across 66 nationalities • 9.4 million internal messages spanning 2006–2024 • 221 million student attendance records • 143,494 employee salary records • 107,603 transport users with home addresses and GPS coordinates • 12,303 teacher passwords (99.98% of which were "giis123") • 616,724 email attachments including medical records, identity documents, and report cards • 46,901 job applicant folders with 12,476 passport copies • 22,996 campus visitor photographs • 112 source code repositories • 168 AWS Secrets Manager entries • evidence of a prior ransomware attack from August 2022

Note: All children's names have been redacted across every file in this release. Unredacted copies were sent to students and their families.

Global Indian International School (GIIS) is the flagship brand of Global Schools Foundation -- known internally as GSG -- a K-12 education holding company headquartered in Singapore operating four school brands (GIIS, OWIS, Glendale, East Academy) across India, the UAE, Malaysia, Japan, Vietnam, and Saudi Arabia. GSG is backed by Apollo Global Management, which has committed approximately S$440 million in capital and described its plans to deploy US$1.5–2 billion in further school acquisitions.

They run 70+ campuses. They serve tens of thousands of children across 7 countries. They hold the most intimate data a school can hold: passport numbers, medical records, mental health crises, family communications that parents send in confidence believing they are private.

All of it was protected by the password "giis123". Default and reused credentials across their cloud environments. They were even hit by an automated ransomware attack in 2022 and never noticed, never cleaned up the READ_ME_TO_RECOVER_YOUR_DATA ransom note.

But it's even worse than that; they also engaged in the most absurd, illogical, and flat-out insane behaviour we have ever seen in negotiations, and likely ever will. It would almost be comical if the stakes weren't their own students' most sensitive data.

We gained initial access to GSG's AWS environment (account 199031240001, ap-southeast-1) in early April 2026. Shockingly, they still have not determined how, despite the very basic nature of the compromise, so we don't want to give it away here yet.

What we can say is what we found there. 67 S3 buckets across their mess of an AWS account. Five live MSSQL servers, all accessible with the same credentials, zero access controls: no VPC, no firewalls. Four MongoDB servers still running the credentials set in 2022. 168 secrets in AWS Secrets Manager, because of course they were using their root AWS account for literally everything.

The teacher/staff authentication database -- the system that controlled access to student records, parent communications, and administrative tools across every campus -- stored 12,303 passwords in plaintext. Not hashed. Not encrypted. Plaintext. And 12,301 of those passwords were identical: giis123. The remaining two were giis1234 and shail110.

We exfiltrated 4.8 terabytes over a week. Nobody noticed. If we hadn't contacted them, they probably never would have.

---

YEARS OF NEGLIGENCE

This was not GSG's first breach. This is a clearly demonstrated pattern of negligence for them.

On both MongoDB servers -- 13.250.47.35 and 13.212.148.158 -- we found a database named READ_ME_TO_RECOVER_YOUR_DATA containing four identical ransom notes. The ObjectID timestamps decode to August 5–9, 2022. A previous attacker compromised these servers nearly four years ago, partially wiped databases, and left ransom demands. Contact emails: [email protected] and [email protected]. BTC wallet: 12nx7Q6FAczH6yfhaEMJRmvRkavDTcwUJK. (Is this any of you guys lmao?)

The ransom note databases were never cleaned up. They were still there when we arrived in April 2026. Perhaps they were never noticed ; the attack was obviously automated and they didn't hit any critical data. But still. The MongoDB credentials -- mongostage / stagemongodb@0, root / testmongodb0 -- were the same ones valid in 2022. The staging server password was literally stagemongodb@0.

GSG was breached four years ago. They did not remediate. They did not rotate credentials. They did not notify anyone. They left the ransom notes sitting in their databases like participation trophies and carried on as if nothing had happened.

Instead, when we notified them of this fact, they tried to use the existence of the ransom notes as an excuse not to pay the price we named to delete the data. Their argument was they'd been breached before, so the data was out there. This is a common concern, but in this specific case, it is patently absurd.

The two databases that were breached contained only a few gigabytes of data. The cloud ransomware attempt was obviously part of an automated campaign (it wiped only a few tables, leaving the important ones) by an idiot -- the sort of mass exploitation that targets databases with extremely weak or default credentials, like the infosec masterwork that is stagemongodb@0.

They told us their data was "not worth" what we were asking. They said "people have short memory."

We disagree. 

And now, since we have emailed all ~69,000 parents of students across their campuses, they are beginning to receive a wave of outrage, to the point where they sent us a meaningless, senseless cease and desist: https://fulcrumsec.vg/gsg/ceasedesist.png

Which is pretty funny, since their moronic negotiator had just spent weeks babbling about how insensitive all of this data was. Guess they changed their minds?

In any case, we declined to comply: https://fulcrumsec.vg/gsg/GSlawyers2.png

THE DATA

We created a curate highlights pack for your viewing pleasure. Here's a file tree -- see further down for a detailed map and explanation of the data:

GSG_highlights/                                               111 GB

01_internal_messages/                                         9.6 GB
  Complete PG_Campus_Mails database from GSG's dedicated mail server.
  Every parent-teacher-administrator message across all campuses since 2006.
    dbo.ICSMail.jsonl.gz            1.6 GB    8,584,247 messages (main)
    dbo.ICSMail_bk_04122024.jsonl.gz            9,423,882 messages (backup)
    dbo.ICSMail_13032025.jsonl.gz               8,539,414 messages (snapshot)
    dbo.ICSMail_New.jsonl.gz                    3,494,952 messages
    dbo.ICSMailDetail*.jsonl.gz    42,112,325 routing records (who sent to whom)
    + attachments, broadcast mails, settings, flags

02_student_databases/                                         687 MB
  The core identity databases.
    ICSStuInfo_FULL_35938_STUDENTS.jsonl         DECOMPRESSED, READY TO VIEW
      35,938 student records, 197 columns each
      14,908 student passports, 8,977 father passports, 9,203 mother passports
      Home addresses, employer, income, medical conditions, religion, caste
    TEACHER_PASSWORDS_PLAINTEXT_12303.jsonl      DECOMPRESSED, READY TO VIEW
      12,303 accounts. 12,301 passwords = "giis123". In plaintext.
    PG_Campus_Users/                68 tables
    PG_Campus_Teachers/             24 tables
    SITUsers.json                   71,547 user records across all campuses

03_applicants/                                                 92 GB
  Complete gsf-career S3 bucket. Job applicant document storage.
    ApplicantDocuments/             46,901 individual folders
      12,476 folders with passport scans (JPG/PDF)
       6,139 folders with visa or work permit copies
         142 folders with Aadhaar cards (Indian biometric ID)
         163 folders with credit card statements
         153 folders with medical certificates
      20,881 folders with resumes/CVs
    These are the actual scanned documents -- passport bio pages, visa stamps, government identity cards.

04_visitor_photos/                                            2.3 GB
  22,996 photographs of every person who entered a GSG campus.

05_employee_compensation/                                      77 MB
    143,494 salary records
      8,416 Annual CTC records
     25,332 performance appraisals with manager ratings
     12,602 variable pay records

06_source_code/                                               2.5 GB
  112 CodeCommit repositories. Complete SmartLearn/MyGIIS platform.
  Backend (C#/.NET), frontend (Angular/React), mobile (Android/iOS),
  infrastructure (ArgoCD, IdentityService, GlobalLogin).
  Hardcoded credentials throughout.

07_credentials/                                               548 KB
    168 AWS Secrets Manager entries
     19 unique AWS access key pairs
     22 unique SQL Server passwords
     18 MongoDB connection strings with embedded credentials
     JWT signing keys, AES-256 keys + IVs, SMTP passwords,
     Twilio auth tokens, Google OAuth, Zoom OAuth, Firebase

08_mongodb/                                                   1.1 GB
  4 MongoDB server dumps. 43 JSON files.
    107,603 transport users with home addresses
    183,731 daily trip attendance records with GPS coordinates
     25,362 staff-parent messages
     13,195 chat threads
    268,968 helpdesk user accounts
    READ_ME_TO_RECOVER_YOUR_DATA   (the 2022 ransom notes, still there)

09_twilio_sms/                                                1.5 GB
  Complete Twilio account dump -- production SMS system.
    122,862 SMS messages (through April 30, 2026)
     34,708 unique phone numbers across 7 countries
      5,211 unique student names linked to parent phones
    3 GSG-owned phone numbers:
      +14243519626 (US), +601130115667 (MY), +6582410436 (SG)

10_hrms/                                                      1.8 GB
  Employee attendance, leave, reporting lines, HR files.

11_user_photos/                                                62 MB
  Staff and user profile photographs.


Links to download highlights:

Hidden Content

You must register or login to view this content.

And here is a cut version we made for rapid downloads. The main part that’s removed is ~90 GB of applicant/employee ID and passport scans. We made this because dozens of students are emailing us asking for the data and having trouble pulling large files.

Hidden Content

You must register or login to view this content.

Keep an eye on the post on our site for the full 4.8 TB download, coming soon!


PASSPORT NUMBERS - 33,088 ACROSS 66 NATIONALITIES

The ICSStuInfo_FULL_35938_STUDENTS.jsonl file in 02_student_databases/ is decompressed and ready to open. One line per student. 197 fields per line. The passport columns are called Passport, FthPassport, and MthPassport. 14,908 student passports. 8,977 father passports. 9,203 mother passports. Indian, Singaporean, Emirati, Chinese, Japanese, Malaysian, American, British, Pakistani, Bangladeshi, Sri Lankan, Australian, Korean, Filipino, Iranian, Myanmar : 66 nationalities in total.

Some very prominent families go to these schools. Hopefully this will change after they learn of the breach, but at the moment, these families include: the Ambassador of Uzbekistan to Singapore (passport DA0006280, daughter's passport DA0006301, home address: 18 Tanglin Walk, Tanglin Hill Condominium). A Goldman Sachs Executive Director (passport Z6208645, son's passport V1146894, home: Block 297, Punggol Central, #14-485). A Vice President of GIC Special Investments -- Singapore's $800 billion sovereign wealth fund (passport F7623934, son's passport H8673949, home: 26 Bayshore Road, The Bayshore, #18-07). A JPMorgan Chase VP in Tokyo earning ¥10,000,000. A Facebook/Meta Director with Singaporean passport K0985142B. A Korean Army officer. An Egyptian diplomat from the Ministry of Foreign Affairs. 218 Standard Chartered Bank families. 239 Tata Consultancy Services families. 113 Accenture families.

These are not credit card numbers that can be easily cancelled. These are government identity documents belonging to children and their families. For many of these nationalities, passport replacement is expensive, slow, and bureaucratically painful. For some, it requires an embassy visit in a country they may not live in. But that's not actually a cause for concern, according to GSG's negotiator:



See? Losing the passport data for every student and every family who ever attended their schools is no big deal; it'll all expire in 5–10 years. That's basically no time at all. Totally unimportant, just like the thousands of emails of parents talking about their children's mental health and behavioural problems and photocopies of the government IDs and passports for everyone who works for them or has applied for a job.


9.4 MILLION INTERNAL MESSAGES (2006–2024)

The complete PG_Campus_Mails database: every message ever sent between parents, teachers, counsellors, coordinators, and administrators across every GSG campus for nearly two decades. 8,584,247 messages on the main table alone. Full HTML bodies, subjects, sender IDs, timestamps. ~42 million routing records mapping every sender-to-recipient relationship.

We ran keyword searches across the full corpus and verified the following:

- 14,236 medical disclosures naming specific children with specific conditions
- 2,115 bullying reports naming assailants and victims
- 4,242 incident reports (physical altercations between named students)
- 1,064 disciplinary actions (theft, misconduct, warning cards)
- 170 harassment complaints including physical and sexual harassment
- 550 accident reports
- 271 warning letters to parents about named children
- 618 salary grievances from teachers revealing individual pay ("my salary is 3200")
- 410 resignation letters with personal circumstances
- 70 suicide references
- 37 self-harm disclosures
- 184 messages explicitly flagged as confidential by senders

We include a sample of these in an appendix below the post on our site -- go ahead and take a look. GSG deemed these "not significant". We do not agree.

Parents send these messages in trust. They write to their child's teacher about a suicide attempt, a panic attack, a bullying incident, an abuse disclosure -- and they believe that communication is confidential. GSG stored it all in one database, behind one password, with no encryption, for eighteen years.

We extracted thousands of extraordinarily sensitive communications throughout the email databases. Below are a few samples. We have redacted students' names, because unlike GSG, we give a damn about children's safety.

A principal in Singapore, writing to a parent: "She shared that she overdosed on Ibuprofen the previous night and was also in possession of her prescription psychiatric medication (23 tablets in an unmarked bottle). She said that she has been experiencing feelings of self harm since a week. While waiting for you to reach school, she impulsively took cough syrup in the sick room as well."

A school counsellor in Singapore: "She insisted that she was feeling suicidal and somebody in her head was telling her to do harmful things. She even listed out examples such as while crossing the road to stand in front of the car. [REDACTED] and her friends had been in contact with me for the past two to three weeks explicitly mentioning her suicidal thoughts."

A parent writing about her daughter's hospitalisation: "I would like to advise you that [REDACTED] has been admitted to the hospital for observation due to her claims of being suicidal."

A teacher in Bangalore: "Today during the lunch break, [REDACTED] removed the blade from her sharpener and tried to self harm. She has got a few scratches on her hand."

A teacher's anecdotal record: "[REDACTED] has been increasingly talking about suicide, depression and is often heard making statements such as 'I want to cut myself,' 'I want to fake my death,' 'I want to jump off from a height to see if people care for me.' The frequency and intensity of these statements is alarming."

A parent from the Singapore campus: "She stated that she has been contemplating self-harm, including cutting her hands and throat. This is an extremely alarming situation."

A parent in Singapore writing about another child in her daughter's class: "She tried to cut her wrist with a fork in the school cafeteria."

A parent from Dubai: "My daughter developed severe depression because of the bullying suffered on the school. From June last year I am informing the school what is happening. [...] The school did nothing. This led my daughter to a state of depression up to the point to hurt herself."

A mother in Tokyo, writing matter-of-factly about her six-year-old daughter: "I believe it is thanks to Ms. Priyanka that even though she is kicked, molested and abused by her classmates, she does not miss school."

There are thousands more. 

These children trusted their school. Their parents trusted their school. GSG stored their most vulnerable moments -- overdoses, self-harm, suicidal ideation, abuse, psychiatric hospitalisations -- in a database accessible to anyone with the password giis123, which was every teacher in the organisation.


TRANSPORT AND PHYSICAL TRACKING

107,603 transport user records with residential addresses, dates of birth, phone numbers. 183,731 daily trip attendance records mapping when children were picked up and dropped off. 1,925 bus stops with GPS coordinates. 1,079 bus routes.

Combined with the 221 million student attendance log entries, which track every day every student was present or absent at every campus, this data reconstructs the daily physical movements of tens of thousands of minors across seven countries.

EMPLOYEE DATA

143,494 salary records with annual CTC values. 25,332 performance appraisal records with manager ratings and comments. 12,602 variable pay records. 156,964 HRMS attendance records including check-in/out times and campus locations. 2,311 reporting line records with named managers. Complete organisational hierarchy. Salary amounts range from SGD 3,200/month for junior teachers to SGD 350,000+ per year for senior leadership.

JOB APPLICANTS

46,901 applicant folders in 03_applicants/. These contain passport photocopies, work permit photocopies. Indian Aadhaar biometric ID cards. 163 contain credit card statements. 153 contain medical certificates.


EVERYTHING ELSE

- 22,996 campus visitor photographs across 14 campuses 
- 616,724 email attachments (254 GB) including report cards, bonafide letters with passport and NRIC numbers, medical certificates with government IDs
- 122,862 Twilio SMS messages to 34,708 unique phone numbers -- GSG's own phone numbers, including branded UAE sender IDs (GIIS DXB, GIISAUH, EASCHOOLSHJ, GIS-DXB, GLOBALSA)
- 112 CodeCommit source code repositories -- complete SmartLearn platform with hardcoded AWS keys

---

THE WORLD'S DUMBEST NEGOTIATORS

We do not normally publish our correspondence with breached companies. We have only done this once before, with youX when they served us with an injunction after we took down our posts. But GSG's conduct was so extraordinary -- so dishonest, so stupid, so contemptuous of the process, which every company but them takes with the utmost seriousness -- that we are making an exception.

We contacted GSG in early May and offered them a fair settlement of $750k. For context, our ask was less than what a single year's tuition costs for a classroom of students at their Singapore campus. It was 0.17% of Apollo's committed capital. It was, by any measure, a fraction of the regulatory and legal exposure GSG now faces.

GSG's response was to lie. Repeatedly. About everything.

LIE #1: "MANY OF OUR BRANCHES ARE FRANCHISEES"

GSG claimed their campuses were independent franchisees, not company-owned. This was false. In July 2023, their own press release announced that Apollo had nearly doubled its commitment to S$440 million, funding "over US$650 million" in investments and "over 25 acquisitions" -- described as "100% acquisition." Dwight School Seoul, Glendale Academy Hyderabad, Silveroaks Bangalore, Regent International Malaysia. Full acquisitions. Not franchise agreements. There are dozens of articles and announcements making this fact very clear.

The franchise model ended years ago. GIIS Chinchwad became Elpro International School when the franchise expired. GIIS Dubai's original partner, Scoreplus Education, split from GSG in 2012. GIIS Surat closed. We laid all of this out. GSG's negotiator responded with obfuscation and dumb bluster, and pivoted to another angle in their attempt to lower the price.

LIE #2: "SHINYHUNTERS IS EXTORTING US"

GSG initially claimed ShinyHunters had taken the same data at an earlier date and were also extorting them. They said ShinyHunters had "showed them the entire database" (as if it were a single database that we had taken), so they "knew they had it", unlike us. We contacted ShinyHunters directly to ask them about this. They said they had never heard of them.



When we relayed this, GSG did not miss a beat; they simply swapped out ShinyHunters for unnamed "other groups" -- conveniently unverifiable.

But sure, okay, we thought. With their abysmal security, it was not impossible for multiple attackers to have gotten overlapping data. Maybe they were just confused about how data, breaches, and data breaches worked. We were ready to chalk it up to ignorance rather than deceit.

But that was before we realized what sort of deranged pathological liars we were dealing with.

LIE #3: "OVER 99% OF THE DATA IS ALREADY ON THE DARK WEB OR HAVE I BEEN PWNED"

You can see this claim in the screenshot above. They repeatedly made this claim, which is bizarre, because all it takes is subscribing to HIBP to see that this is completely and utterly false. Some of the emails are in there, true, because the fact is everyone's email has been in multiple data breaches. But that's it: just emails. Maybe a few addresses, though we couldn't find any. What certainly was not present: a single passport number of their students or parents, a single government ID card of any of their applicants, and of course, not a single sensitive email discussing their students' most personal issues.

LIE #4: THE FABRICATED DARK WEB LISTING

This is where it gets truly insane.

GSG's negotiator sent us a screenshot of a dark web forum post allegedly showing our data being sold by a user called "LedgerWraith" for $250,000. They claimed it was discovered by a monitoring service called "CloudSec."



The listing was fake. Every number in it -- the 4.8 TB, the 35,938 student records, the 33,000 passport numbers, the 9.4 million messages, the 221 million attendance rows, the 143,000 salary records -- was copied directly from our own communications with GSG. Our exact deduped numbers. Even if another actor had gained access to precisely the same services we had, we deduped and quantified it in an idiosyncratic fashion. There is close to zero percent chance that they would have the same counts for a single data source, let alone all of them. The language, also, mimicked the emails we had sent them. The phrase "random file selection supported for scope verification" was lifted from our verification offer.

They also apparently fed the AI several of our leak posts, since some styling appears to be poor, inane, cringeworthy imitations of our own writing on our site. The line "Centralised means one key, everything. The inbox was the front door" bookended by idiotic emojis, in particular, is one of the most cringe things we have ever seen generated by AI. The fact that it was used with a straight face -- to apparently convince us that we had written it ourselves -- absolutely boggles the mind.

Furthermore, as posters here will know who knows the underground market ecosystem will notice that the price is absurd: $250,000 as a "starting bid" for school data on a "dark web forum" -- this is not a price this sort of data would ever go for. Period. Not even 10% that price. Maybe 5%. As a comparison, we recently saw TeamPCP's listing for the entirety of Eli Lilly's source code -- ~1,400 GitHub repositories -- for $70,000. And that's one of the highest listings we have ever seen. $250k is exactly what it looks like, a fictitious number hallucinated by an LLM and used by morons who couldn't be bothered even to lie properly.

The account "LedgerWraith" does not exist on any dark web forum. The monitoring service "CloudSec" does not perform dark web monitoring ; it is a Thai penetration testing firm with no relationship with GSG. GSG does not even operate in Thailand. They fabricated the name, in other words, because it sounded like a cloud security company: CloudSec. Brilliant.

GSG fabricated a dark web listing using an AI chatbot fed with our own correspondence, attributed it to a fictional vendor and sent it to us expecting that 1) we would believe them and 2) the alleged sale would result in a lower price. Their argument: why pay if your own members are out there selling it? Just like their "why pay if ShinyHunters or whoever has it as well?" argument.

This is, without exaggeration, the single dumbest thing we have ever encountered in this line of work. And we encounter a lot of it. This level of senseless self-sabotage, however, is truly next level stupid. The fact that they thought this would be a successful ploy to get us to lower the price makes us wonder how they manage to run a school at all, let alone a chain of them.

These are not the best and the brightest. As if there were not a hundred red flags about the fake listing they sent -- including that there are no such sales posts or users on any underground forum, they could not even get the details right between the two ostensible "screenshots" of the fictitious listing. We're limited on how many images we can attach here, so see the post on our site, but they couldn't even keep the forgery consistent.

THE AFTERMATH

When we confronted GSG about their fabricated "evidence", their response was to say that they knew we would claim it was a fake, and pivot into using the alleged "sale" as a reason not to pay the full price for deletion -- as they had planned all along.

They then offered us $100,000. Again. But at that point, we were so disgusted that no amount of money would have gotten them off the hook. The fake post was a step too far, and in using it and doubling down on the lie, they torpedoed any chance of a settlement and condemned themselves to face the consequences.



The entire chain of events has been difficult for us to believe. A school holding 33,000 children's passport numbers, mental health records documenting suicide attempts and self-harm, and 9.4 million private parent-teacher communications -- a school backed by $440 million in Apollo capital -- was offered the chance to resolve this for a relative pittance and instead chose to fabricate evidence, lie about their corporate structure, invent phantom threat actors, and completely fictionalise the presence of the data on data leak / dark web tracking sites like Have I Been Pwned.

WHAT WE ARE RELEASING TODAY -- A DETAILED MAP OF THE HIGHLIGHTS PACK

We are releasing a curated 111 GB highlights pack. The full 4.8 TB dump will follow soon.

Children's names are redacted throughout. We do this not for GSG's sake, but in spite of them. We take no pleasure in publishing any of this. We are doing so because we believe parents have a right to know what their school allowed to be exposed, and the way it was "protected", if you can even call it that.

We will share the complete unredacted dataset with:

- Verified journalists investigating the breach
- The Singapore PDPC, India's Data Protection Authority, and the UAE data protection office
- Attorneys representing affected families
- Verified researchers

If you would like a copy, send us an email (use your company domain) at [email protected].

The pack contains the following:

01 - Internal Messages (9.6 GB). The complete PG_Campus_Mails database from GSG's dedicated mail server. Every message ever sent between parents, teachers, counsellors, and administrators across every campus since 2006. 8.5 million messages on the main table, with multiple temporal snapshots (December 2024 backup, March 2025 snapshot) enabling forensic comparison. 42 million routing records mapping every sender-to-recipient relationship. 3,489 mail attachment records with S3 URLs. This is where the suicide disclosures, bullying reports, salary grievances, harassment complaints, and confidential-flagged messages live.

02 - Student Databases (687 MB). The core identity databases for every student, parent, and teacher across all GSG campuses. The centrepiece is ICSStuInfo_FULL_35938_STUDENTS.jsonl -- decompressed, one student per line, 197 columns, ready to open in any text editor. 35,938 students, 33,088 passport numbers (student, father, mother). Home addresses with block/unit/postal code. Both parents' employers, positions, and income brackets. Medical conditions, religion, caste, emergency contacts. Also includes 12,303 teacher accounts with passwords stored in plaintext - 12,301 of which are giis123 - decompressed as TEACHER_PASSWORDS_PLAINTEXT_12303.jsonl. Plus the 71,547-record SITUsers.json user directory spanning all campuses and brands.

03 - Applicant Documents (92 GB). The complete gsf-career S3 bucket. 46,901 individual folders, one per job applicant. These are not database records -- these are the actual scanned documents. Photographs of passport bio pages, visa stamps, and government-issued identity cards. 12,476 folders contain passport scans. 6,139 contain visa or work permit copies. 142 contain Aadhaar cards (Indian biometric national ID). 163 contain credit card statements. 153 contain medical certificates. In addition to Indian applicants, citizens of Korea, America, the UK, Japan, and Australia are impacted, to name a few. This is the largest component of the pack by size.

04 - Visitor Photos (2.3 GB). 22,996 photographs of every person who physically entered a GSG campus - parents, visitors, delivery personnel, contractors. Each linked to a visitor record with name, phone, email, government ID, purpose of visit, and blacklist status.

05 - Employee Compensation (77 MB). Complete salary and performance data for every GSG employee across all campuses. 143,494 salary records with individual amounts per salary head. 8,416 Annual CTC records. 25,332 performance appraisals with manager ratings, comments, and targets. 12,602 variable pay records with increment percentages. 957 PMS Excel files and 25 HR letters. Salary amounts range from SGD 3,200/month for junior teachers to SGD 350,000+/year for leadership.

06 - Source Code (2.5 GB). 112 CodeCommit repositories comprising the complete SmartLearn/MyGIIS platform -- backend (C#/.NET), frontend (Angular/React), mobile (Android/iOS), and infrastructure (ArgoCD, IdentityService, GlobalLogin). Hardcoded credentials throughout: AWS access keys in Angular environment files visible to any browser, database connection strings with Encrypt=false, JWT signing keys, AES-256 encryption keys.

07 - Credentials (548 KB). The full AWS Secrets Manager dump. 168 entries covering every microservice across all environments. These are rotated now -- it took them several weeks after we contacted them -- but we want to show the scale of the exposure.

08 - MongoDB (1.1 GB). Dumps from 4 MongoDB servers. 107,603 transport users with home addresses. 183,731 daily trip records with GPS coordinates. 1,925 bus stops, 1,079 routes. 25,362 staff-parent messages. 13,195 chat threads. 268,968 helpdesk accounts. And READ_ME_TO_RECOVER_YOUR_DATA -- the 2022 ransom notes, still sitting there four years later.

09 - Twilio SMS (1.5 GB). Complete production Twilio account dump. 122,862 SMS messages up through April 2026. 34,708 unique phone numbers across 7 countries. 5,211 unique student names linked to parent phones. GSG's 3 owned phone numbers (+14243519626 US, +601130115667 Malaysia, +6582410436 Singapore) and 6 branded UAE sender IDs (GIIS DXB, GIISAUH, EASCHOOLSHJ, GIS-DXB, EASCHOOL, GLOBALSA).

10 - HRMS (1.8 GB). Human Resources Management System data. 156,964 employee attendance records. Leave balances. 2,311 reporting line records with named managers. 2,916 HR files from the gsg-hrms S3 bucket.

11 - User Photos (62 MB). Staff and user profile photographs from the gsg-users S3 bucket.

Finally, we’d like to direct your attention to the CEO and founder of this institution: Mr Atul Temurnikar. This is the man who is directly responsible for this disaster. The man whose mic appears to have been swallowed by his bloated face.




We strongly suspect that he is the individual we were negotiating with, or if not, he was at least directly involved in the negotiations. At one point we sent Mr Temurnikar an email requesting the negotiator be replaced, as his combination of arrogance, immaturity and idiocy was going to lead to a disastrous outcome. 

And what a surprise, that disaster came to pass.

We hope the takeaway from all of this is a clear one: If you cannot afford to protect your students' data, you cannot afford to collect it.

We look forward to watching the tsunami of lawsuits Global Schools will be hit with imminently.

[RoavingRAT]

Interesante, thank you

[Qusenyx1023]

Let see

[natas]

The Global Schools / GIIS / GSG Leaks

33,088 passport numbers belonging to children and their parents across 66 nationalities • 9.4 million internal messages spanning 2006–2024 • 221 million student attendance records • 143,494 employee salary records • 107,603 transport users with home addresses and GPS coordinates • 12,303 teacher passwords (99.98% of which were "giis123") • 616,724 email attachments including medical records, identity documents, and report cards • 46,901 job applicant folders with 12,476 passport copies • 22,996 campus visitor photographs • 112 source code repositories • 168 AWS Secrets Manager entries • evidence of a prior ransomware attack from August 2022

Note: All children's names have been redacted across every file in this release. Unredacted copies were sent to students and their families.

Global Indian International School (GIIS) is the flagship brand of Global Schools Foundation -- known internally as GSG -- a K-12 education holding company headquartered in Singapore operating four school brands (GIIS, OWIS, Glendale, East Academy) across India, the UAE, Malaysia, Japan, Vietnam, and Saudi Arabia. GSG is backed by Apollo Global Management, which has committed approximately S$440 million in capital and described its plans to deploy US$1.5–2 billion in further school acquisitions.

They run 70+ campuses. They serve tens of thousands of children across 7 countries. They hold the most intimate data a school can hold: passport numbers, medical records, mental health crises, family communications that parents send in confidence believing they are private.

All of it was protected by the password "giis123". Default and reused credentials across their cloud environments. They were even hit by an automated ransomware attack in 2022 and never noticed, never cleaned up the READ_ME_TO_RECOVER_YOUR_DATA ransom note.

But it's even worse than that; they also engaged in the most absurd, illogical, and flat-out insane behaviour we have ever seen in negotiations, and likely ever will. It would almost be comical if the stakes weren't their own students' most sensitive data.

We gained initial access to GSG's AWS environment (account 199031240001, ap-southeast-1) in early April 2026. Shockingly, they still have not determined how, despite the very basic nature of the compromise, so we don't want to give it away here yet.

What we can say is what we found there. 67 S3 buckets across their mess of an AWS account. Five live MSSQL servers, all accessible with the same credentials, zero access controls: no VPC, no firewalls. Four MongoDB servers still running the credentials set in 2022. 168 secrets in AWS Secrets Manager, because of course they were using their root AWS account for literally everything.

The teacher/staff authentication database -- the system that controlled access to student records, parent communications, and administrative tools across every campus -- stored 12,303 passwords in plaintext. Not hashed. Not encrypted. Plaintext. And 12,301 of those passwords were identical: giis123. The remaining two were giis1234 and shail110.

We exfiltrated 4.8 terabytes over a week. Nobody noticed. If we hadn't contacted them, they probably never would have.

---

YEARS OF NEGLIGENCE

This was not GSG's first breach. This is a clearly demonstrated pattern of negligence for them.

On both MongoDB servers -- 13.250.47.35 and 13.212.148.158 -- we found a database named READ_ME_TO_RECOVER_YOUR_DATA containing four identical ransom notes. The ObjectID timestamps decode to August 5–9, 2022. A previous attacker compromised these servers nearly four years ago, partially wiped databases, and left ransom demands. Contact emails: [email protected] and [email protected]. BTC wallet: 12nx7Q6FAczH6yfhaEMJRmvRkavDTcwUJK. (Is this any of you guys lmao?)

The ransom note databases were never cleaned up. They were still there when we arrived in April 2026. Perhaps they were never noticed ; the attack was obviously automated and they didn't hit any critical data. But still. The MongoDB credentials -- mongostage / stagemongodb@0, root / testmongodb0 -- were the same ones valid in 2022. The staging server password was literally stagemongodb@0.

GSG was breached four years ago. They did not remediate. They did not rotate credentials. They did not notify anyone. They left the ransom notes sitting in their databases like participation trophies and carried on as if nothing had happened.

Instead, when we notified them of this fact, they tried to use the existence of the ransom notes as an excuse not to pay the price we named to delete the data. Their argument was they'd been breached before, so the data was out there. This is a common concern, but in this specific case, it is patently absurd.

The two databases that were breached contained only a few gigabytes of data. The cloud ransomware attempt was obviously part of an automated campaign (it wiped only a few tables, leaving the important ones) by an idiot -- the sort of mass exploitation that targets databases with extremely weak or default credentials, like the infosec masterwork that is stagemongodb@0.

They told us their data was "not worth" what we were asking. They said "people have short memory."

We disagree. 

And now, since we have emailed all ~69,000 parents of students across their campuses, they are beginning to receive a wave of outrage, to the point where they sent us a meaningless, senseless cease and desist: https://fulcrum.st/gsg/ceasedesist.png

Which is pretty funny, since their moronic negotiator had just spent weeks babbling about how insensitive all of this data was. Guess they changed their minds?

In any case, we declined to comply: https://fulcrum.st/gsg/GSlawyers2.png

THE DATA

We created a curate highlights pack for your viewing pleasure. Here's a file tree -- see further down for a detailed map and explanation of the data:

GSG_highlights/                                               111 GB

01_internal_messages/                                         9.6 GB
  Complete PG_Campus_Mails database from GSG's dedicated mail server.
  Every parent-teacher-administrator message across all campuses since 2006.
    dbo.ICSMail.jsonl.gz            1.6 GB    8,584,247 messages (main)
    dbo.ICSMail_bk_04122024.jsonl.gz            9,423,882 messages (backup)
    dbo.ICSMail_13032025.jsonl.gz               8,539,414 messages (snapshot)
    dbo.ICSMail_New.jsonl.gz                    3,494,952 messages
    dbo.ICSMailDetail*.jsonl.gz    42,112,325 routing records (who sent to whom)
    + attachments, broadcast mails, settings, flags

02_student_databases/                                         687 MB
  The core identity databases.
    ICSStuInfo_FULL_35938_STUDENTS.jsonl         DECOMPRESSED, READY TO VIEW
      35,938 student records, 197 columns each
      14,908 student passports, 8,977 father passports, 9,203 mother passports
      Home addresses, employer, income, medical conditions, religion, caste
    TEACHER_PASSWORDS_PLAINTEXT_12303.jsonl      DECOMPRESSED, READY TO VIEW
      12,303 accounts. 12,301 passwords = "giis123". In plaintext.
    PG_Campus_Users/                68 tables
    PG_Campus_Teachers/             24 tables
    SITUsers.json                   71,547 user records across all campuses

03_applicants/                                                 92 GB
  Complete gsf-career S3 bucket. Job applicant document storage.
    ApplicantDocuments/             46,901 individual folders
      12,476 folders with passport scans (JPG/PDF)
       6,139 folders with visa or work permit copies
         142 folders with Aadhaar cards (Indian biometric ID)
         163 folders with credit card statements
         153 folders with medical certificates
      20,881 folders with resumes/CVs
    These are the actual scanned documents -- passport bio pages, visa stamps, government identity cards.

04_visitor_photos/                                            2.3 GB
  22,996 photographs of every person who entered a GSG campus.

05_employee_compensation/                                      77 MB
    143,494 salary records
      8,416 Annual CTC records
     25,332 performance appraisals with manager ratings
     12,602 variable pay records

06_source_code/                                               2.5 GB
  112 CodeCommit repositories. Complete SmartLearn/MyGIIS platform.
  Backend (C#/.NET), frontend (Angular/React), mobile (Android/iOS),
  infrastructure (ArgoCD, IdentityService, GlobalLogin).
  Hardcoded credentials throughout.

07_credentials/                                               548 KB
    168 AWS Secrets Manager entries
     19 unique AWS access key pairs
     22 unique SQL Server passwords
     18 MongoDB connection strings with embedded credentials
     JWT signing keys, AES-256 keys + IVs, SMTP passwords,
     Twilio auth tokens, Google OAuth, Zoom OAuth, Firebase

08_mongodb/                                                   1.1 GB
  4 MongoDB server dumps. 43 JSON files.
    107,603 transport users with home addresses
    183,731 daily trip attendance records with GPS coordinates
     25,362 staff-parent messages
     13,195 chat threads
    268,968 helpdesk user accounts
    READ_ME_TO_RECOVER_YOUR_DATA   (the 2022 ransom notes, still there)

09_twilio_sms/                                                1.5 GB
  Complete Twilio account dump -- production SMS system.
    122,862 SMS messages (through April 30, 2026)
     34,708 unique phone numbers across 7 countries
      5,211 unique student names linked to parent phones
    3 GSG-owned phone numbers:
      +14243519626 (US), +601130115667 (MY), +6582410436 (SG)

10_hrms/                                                      1.8 GB
  Employee attendance, leave, reporting lines, HR files.

11_user_photos/                                                62 MB
  Staff and user profile photographs.


Links to download highlights:



Keep an eye on the post on our site for the full 4.8 TB download, coming soon!


PASSPORT NUMBERS - 33,088 ACROSS 66 NATIONALITIES

The ICSStuInfo_FULL_35938_STUDENTS.jsonl file in 02_student_databases/ is decompressed and ready to open. One line per student. 197 fields per line. The passport columns are called Passport, FthPassport, and MthPassport. 14,908 student passports. 8,977 father passports. 9,203 mother passports. Indian, Singaporean, Emirati, Chinese, Japanese, Malaysian, American, British, Pakistani, Bangladeshi, Sri Lankan, Australian, Korean, Filipino, Iranian, Myanmar : 66 nationalities in total.

Some very prominent families go to these schools. Hopefully this will change after they learn of the breach, but at the moment, these families include: the Ambassador of Uzbekistan to Singapore (passport DA0006280, daughter's passport DA0006301, home address: 18 Tanglin Walk, Tanglin Hill Condominium). A Goldman Sachs Executive Director (passport Z6208645, son's passport V1146894, home: Block 297, Punggol Central, #14-485). A Vice President of GIC Special Investments -- Singapore's $800 billion sovereign wealth fund (passport F7623934, son's passport H8673949, home: 26 Bayshore Road, The Bayshore, #18-07). A JPMorgan Chase VP in Tokyo earning ¥10,000,000. A Facebook/Meta Director with Singaporean passport K0985142B. A Korean Army officer. An Egyptian diplomat from the Ministry of Foreign Affairs. 218 Standard Chartered Bank families. 239 Tata Consultancy Services families. 113 Accenture families.

These are not credit card numbers that can be easily cancelled. These are government identity documents belonging to children and their families. For many of these nationalities, passport replacement is expensive, slow, and bureaucratically painful. For some, it requires an embassy visit in a country they may not live in. But that's not actually a cause for concern, according to GSG's negotiator:



See? Losing the passport data for every student and every family who ever attended their schools is no big deal; it'll all expire in 5–10 years. That's basically no time at all. Totally unimportant, just like the thousands of emails of parents talking about their children's mental health and behavioural problems and photocopies of the government IDs and passports for everyone who works for them or has applied for a job.


9.4 MILLION INTERNAL MESSAGES (2006–2024)

The complete PG_Campus_Mails database: every message ever sent between parents, teachers, counsellors, coordinators, and administrators across every GSG campus for nearly two decades. 8,584,247 messages on the main table alone. Full HTML bodies, subjects, sender IDs, timestamps. ~42 million routing records mapping every sender-to-recipient relationship.

We ran keyword searches across the full corpus and verified the following:

- 14,236 medical disclosures naming specific children with specific conditions
- 2,115 bullying reports naming assailants and victims
- 4,242 incident reports (physical altercations between named students)
- 1,064 disciplinary actions (theft, misconduct, warning cards)
- 170 harassment complaints including physical and sexual harassment
- 550 accident reports
- 271 warning letters to parents about named children
- 618 salary grievances from teachers revealing individual pay ("my salary is 3200")
- 410 resignation letters with personal circumstances
- 70 suicide references
- 37 self-harm disclosures
- 184 messages explicitly flagged as confidential by senders

We include a sample of these in an appendix below the post on our site -- go ahead and take a look. GSG deemed these "not significant". We do not agree.

Parents send these messages in trust. They write to their child's teacher about a suicide attempt, a panic attack, a bullying incident, an abuse disclosure -- and they believe that communication is confidential. GSG stored it all in one database, behind one password, with no encryption, for eighteen years.

We extracted thousands of extraordinarily sensitive communications throughout the email databases. Below are a few samples. We have redacted students' names, because unlike GSG, we give a damn about children's safety.

A principal in Singapore, writing to a parent: "She shared that she overdosed on Ibuprofen the previous night and was also in possession of her prescription psychiatric medication (23 tablets in an unmarked bottle). She said that she has been experiencing feelings of self harm since a week. While waiting for you to reach school, she impulsively took cough syrup in the sick room as well."

A school counsellor in Singapore: "She insisted that she was feeling suicidal and somebody in her head was telling her to do harmful things. She even listed out examples such as while crossing the road to stand in front of the car. [REDACTED] and her friends had been in contact with me for the past two to three weeks explicitly mentioning her suicidal thoughts."

A parent writing about her daughter's hospitalisation: "I would like to advise you that [REDACTED] has been admitted to the hospital for observation due to her claims of being suicidal."

A teacher in Bangalore: "Today during the lunch break, [REDACTED] removed the blade from her sharpener and tried to self harm. She has got a few scratches on her hand."

A teacher's anecdotal record: "[REDACTED] has been increasingly talking about suicide, depression and is often heard making statements such as 'I want to cut myself,' 'I want to fake my death,' 'I want to jump off from a height to see if people care for me.' The frequency and intensity of these statements is alarming."

A parent from the Singapore campus: "She stated that she has been contemplating self-harm, including cutting her hands and throat. This is an extremely alarming situation."

A parent in Singapore writing about another child in her daughter's class: "She tried to cut her wrist with a fork in the school cafeteria."

A parent from Dubai: "My daughter developed severe depression because of the bullying suffered on the school. From June last year I am informing the school what is happening. [...] The school did nothing. This led my daughter to a state of depression up to the point to hurt herself."

A mother in Tokyo, writing matter-of-factly about her six-year-old daughter: "I believe it is thanks to Ms. Priyanka that even though she is kicked, molested and abused by her classmates, she does not miss school."

There are thousands more. 

These children trusted their school. Their parents trusted their school. GSG stored their most vulnerable moments -- overdoses, self-harm, suicidal ideation, abuse, psychiatric hospitalisations -- in a database accessible to anyone with the password giis123, which was every teacher in the organisation.


TRANSPORT AND PHYSICAL TRACKING

107,603 transport user records with residential addresses, dates of birth, phone numbers. 183,731 daily trip attendance records mapping when children were picked up and dropped off. 1,925 bus stops with GPS coordinates. 1,079 bus routes.

Combined with the 221 million student attendance log entries, which track every day every student was present or absent at every campus, this data reconstructs the daily physical movements of tens of thousands of minors across seven countries.

EMPLOYEE DATA

143,494 salary records with annual CTC values. 25,332 performance appraisal records with manager ratings and comments. 12,602 variable pay records. 156,964 HRMS attendance records including check-in/out times and campus locations. 2,311 reporting line records with named managers. Complete organisational hierarchy. Salary amounts range from SGD 3,200/month for junior teachers to SGD 350,000+ per year for senior leadership.

JOB APPLICANTS

46,901 applicant folders in 03_applicants/. These contain passport photocopies, work permit photocopies. Indian Aadhaar biometric ID cards. 163 contain credit card statements. 153 contain medical certificates.


EVERYTHING ELSE

- 22,996 campus visitor photographs across 14 campuses 
- 616,724 email attachments (254 GB) including report cards, bonafide letters with passport and NRIC numbers, medical certificates with government IDs
- 122,862 Twilio SMS messages to 34,708 unique phone numbers -- GSG's own phone numbers, including branded UAE sender IDs (GIIS DXB, GIISAUH, EASCHOOLSHJ, GIS-DXB, GLOBALSA)
- 112 CodeCommit source code repositories -- complete SmartLearn platform with hardcoded AWS keys

---

THE WORLD'S DUMBEST NEGOTIATORS

We do not normally publish our correspondence with breached companies. We have only done this once before, with youX when they served us with an injunction after we took down our posts. But GSG's conduct was so extraordinary -- so dishonest, so stupid, so contemptuous of the process, which every company but them takes with the utmost seriousness -- that we are making an exception.

We contacted GSG in early May and offered them a fair settlement of $750k. For context, our ask was less than what a single year's tuition costs for a classroom of students at their Singapore campus. It was 0.17% of Apollo's committed capital. It was, by any measure, a fraction of the regulatory and legal exposure GSG now faces.

GSG's response was to lie. Repeatedly. About everything.

LIE #1: "MANY OF OUR BRANCHES ARE FRANCHISEES"

GSG claimed their campuses were independent franchisees, not company-owned. This was false. In July 2023, their own press release announced that Apollo had nearly doubled its commitment to S$440 million, funding "over US$650 million" in investments and "over 25 acquisitions" -- described as "100% acquisition." Dwight School Seoul, Glendale Academy Hyderabad, Silveroaks Bangalore, Regent International Malaysia. Full acquisitions. Not franchise agreements. There are dozens of articles and announcements making this fact very clear.

The franchise model ended years ago. GIIS Chinchwad became Elpro International School when the franchise expired. GIIS Dubai's original partner, Scoreplus Education, split from GSG in 2012. GIIS Surat closed. We laid all of this out. GSG's negotiator responded with obfuscation and dumb bluster, and pivoted to another angle in their attempt to lower the price.

LIE #2: "SHINYHUNTERS IS EXTORTING US"

GSG initially claimed ShinyHunters had taken the same data at an earlier date and were also extorting them. They said ShinyHunters had "showed them the entire database" (as if it were a single database that we had taken), so they "knew they had it", unlike us. We contacted ShinyHunters directly to ask them about this. They said they had never heard of them.



When we relayed this, GSG did not miss a beat; they simply swapped out ShinyHunters for unnamed "other groups" -- conveniently unverifiable.

But sure, okay, we thought. With their abysmal security, it was not impossible for multiple attackers to have gotten overlapping data. Maybe they were just confused about how data, breaches, and data breaches worked. We were ready to chalk it up to ignorance rather than deceit.

But that was before we realized what sort of deranged pathological liars we were dealing with.

LIE #3: "OVER 99% OF THE DATA IS ALREADY ON THE DARK WEB OR HAVE I BEEN PWNED"

You can see this claim in the screenshot above. They repeatedly made this claim, which is bizarre, because all it takes is subscribing to HIBP to see that this is completely and utterly false. Some of the emails are in there, true, because the fact is everyone's email has been in multiple data breaches. But that's it: just emails. Maybe a few addresses, though we couldn't find any. What certainly was not present: a single passport number of their students or parents, a single government ID card of any of their applicants, and of course, not a single sensitive email discussing their students' most personal issues.

LIE #4: THE FABRICATED DARK WEB LISTING

This is where it gets truly insane.

GSG's negotiator sent us a screenshot of a dark web forum post allegedly showing our data being sold by a user called "LedgerWraith" for $250,000. They claimed it was discovered by a monitoring service called "CloudSec."



The listing was fake. Every number in it -- the 4.8 TB, the 35,938 student records, the 33,000 passport numbers, the 9.4 million messages, the 221 million attendance rows, the 143,000 salary records -- was copied directly from our own communications with GSG. Our exact deduped numbers. Even if another actor had gained access to precisely the same services we had, we deduped and quantified it in an idiosyncratic fashion. There is close to zero percent chance that they would have the same counts for a single data source, let alone all of them. The language, also, mimicked the emails we had sent them. The phrase "random file selection supported for scope verification" was lifted from our verification offer.

They also apparently fed the AI several of our leak posts, since some styling appears to be poor, inane, cringeworthy imitations of our own writing on our site. The line "Centralised means one key, everything. The inbox was the front door" bookended by idiotic emojis, in particular, is one of the most cringe things we have ever seen generated by AI. The fact that it was used with a straight face -- to apparently convince us that we had written it ourselves -- absolutely boggles the mind.

Furthermore, as posters here will know who knows the underground market ecosystem will notice that the price is absurd: $250,000 as a "starting bid" for school data on a "dark web forum" -- this is not a price this sort of data would ever go for. Period. Not even 10% that price. Maybe 5%. As a comparison, we recently saw TeamPCP's listing for the entirety of Eli Lilly's source code -- ~1,400 GitHub repositories -- for $70,000. And that's one of the highest listings we have ever seen. $250k is exactly what it looks like, a fictitious number hallucinated by an LLM and used by morons who couldn't be bothered even to lie properly.

The account "LedgerWraith" does not exist on any dark web forum. The monitoring service "CloudSec" does not perform dark web monitoring ; it is a Thai penetration testing firm with no relationship with GSG. GSG does not even operate in Thailand. They fabricated the name, in other words, because it sounded like a cloud security company: CloudSec. Brilliant.

GSG fabricated a dark web listing using an AI chatbot fed with our own correspondence, attributed it to a fictional vendor and sent it to us expecting that 1) we would believe them and 2) the alleged sale would result in a lower price. Their argument: why pay if your own members are out there selling it? Just like their "why pay if ShinyHunters or whoever has it as well?" argument.

This is, without exaggeration, the single dumbest thing we have ever encountered in this line of work. And we encounter a lot of it. This level of senseless self-sabotage, however, is truly next level stupid. The fact that they thought this would be a successful ploy to get us to lower the price makes us wonder how they manage to run a school at all, let alone a chain of them.

These are not the best and the brightest. As if there were not a hundred red flags about the fake listing they sent -- including that there are no such sales posts or users on any underground forum, they could not even get the details right between the two ostensible "screenshots" of the fictitious listing. We're limited on how many images we can attach here, so see the post on our site, but they couldn't even keep the forgery consistent.

THE AFTERMATH

When we confronted GSG about their fabricated "evidence", their response was to say that they knew we would claim it was a fake, and pivot into using the alleged "sale" as a reason not to pay the full price for deletion -- as they had planned all along.

They then offered us $100,000. Again. But at that point, we were so disgusted that no amount of money would have gotten them off the hook. The fake post was a step too far, and in using it and doubling down on the lie, they torpedoed any chance of a settlement and condemned themselves to face the consequences.



The entire chain of events has been difficult for us to believe. A school holding 33,000 children's passport numbers, mental health records documenting suicide attempts and self-harm, and 9.4 million private parent-teacher communications -- a school backed by $440 million in Apollo capital -- was offered the chance to resolve this for a relative pittance and instead chose to fabricate evidence, lie about their corporate structure, invent phantom threat actors, and completely fictionalise the presence of the data on data leak / dark web tracking sites like Have I Been Pwned.

WHAT WE ARE RELEASING TODAY -- A DETAILED MAP OF THE HIGHLIGHTS PACK

We are releasing a curated 111 GB highlights pack. The full 4.8 TB dump will follow soon.

Children's names are redacted throughout. We do this not for GSG's sake, but in spite of them. We take no pleasure in publishing any of this. We are doing so because we believe parents have a right to know what their school allowed to be exposed, and the way it was "protected", if you can even call it that.

We will share the complete unredacted dataset with:

- Verified journalists investigating the breach
- The Singapore PDPC, India's Data Protection Authority, and the UAE data protection office
- Attorneys representing affected families
- Verified researchers

If you would like a copy, send us an email (use your company domain) at [email protected].

The pack contains the following:

01 - Internal Messages (9.6 GB). The complete PG_Campus_Mails database from GSG's dedicated mail server. Every message ever sent between parents, teachers, counsellors, and administrators across every campus since 2006. 8.5 million messages on the main table, with multiple temporal snapshots (December 2024 backup, March 2025 snapshot) enabling forensic comparison. 42 million routing records mapping every sender-to-recipient relationship. 3,489 mail attachment records with S3 URLs. This is where the suicide disclosures, bullying reports, salary grievances, harassment complaints, and confidential-flagged messages live.

02 - Student Databases (687 MB). The core identity databases for every student, parent, and teacher across all GSG campuses. The centrepiece is ICSStuInfo_FULL_35938_STUDENTS.jsonl -- decompressed, one student per line, 197 columns, ready to open in any text editor. 35,938 students, 33,088 passport numbers (student, father, mother). Home addresses with block/unit/postal code. Both parents' employers, positions, and income brackets. Medical conditions, religion, caste, emergency contacts. Also includes 12,303 teacher accounts with passwords stored in plaintext - 12,301 of which are giis123 - decompressed as TEACHER_PASSWORDS_PLAINTEXT_12303.jsonl. Plus the 71,547-record SITUsers.json user directory spanning all campuses and brands.

03 - Applicant Documents (92 GB). The complete gsf-career S3 bucket. 46,901 individual folders, one per job applicant. These are not database records -- these are the actual scanned documents. Photographs of passport bio pages, visa stamps, and government-issued identity cards. 12,476 folders contain passport scans. 6,139 contain visa or work permit copies. 142 contain Aadhaar cards (Indian biometric national ID). 163 contain credit card statements. 153 contain medical certificates. In addition to Indian applicants, citizens of Korea, America, the UK, Japan, and Australia are impacted, to name a few. This is the largest component of the pack by size.

04 - Visitor Photos (2.3 GB). 22,996 photographs of every person who physically entered a GSG campus - parents, visitors, delivery personnel, contractors. Each linked to a visitor record with name, phone, email, government ID, purpose of visit, and blacklist status.

05 - Employee Compensation (77 MB). Complete salary and performance data for every GSG employee across all campuses. 143,494 salary records with individual amounts per salary head. 8,416 Annual CTC records. 25,332 performance appraisals with manager ratings, comments, and targets. 12,602 variable pay records with increment percentages. 957 PMS Excel files and 25 HR letters. Salary amounts range from SGD 3,200/month for junior teachers to SGD 350,000+/year for leadership.

06 - Source Code (2.5 GB). 112 CodeCommit repositories comprising the complete SmartLearn/MyGIIS platform -- backend (C#/.NET), frontend (Angular/React), mobile (Android/iOS), and infrastructure (ArgoCD, IdentityService, GlobalLogin). Hardcoded credentials throughout: AWS access keys in Angular environment files visible to any browser, database connection strings with Encrypt=false, JWT signing keys, AES-256 encryption keys.

07 - Credentials (548 KB). The full AWS Secrets Manager dump. 168 entries covering every microservice across all environments. These are rotated now -- it took them several weeks after we contacted them -- but we want to show the scale of the exposure.

08 - MongoDB (1.1 GB). Dumps from 4 MongoDB servers. 107,603 transport users with home addresses. 183,731 daily trip records with GPS coordinates. 1,925 bus stops, 1,079 routes. 25,362 staff-parent messages. 13,195 chat threads. 268,968 helpdesk accounts. And READ_ME_TO_RECOVER_YOUR_DATA -- the 2022 ransom notes, still sitting there four years later.

09 - Twilio SMS (1.5 GB). Complete production Twilio account dump. 122,862 SMS messages up through April 2026. 34,708 unique phone numbers across 7 countries. 5,211 unique student names linked to parent phones. GSG's 3 owned phone numbers (+14243519626 US, +601130115667 Malaysia, +6582410436 Singapore) and 6 branded UAE sender IDs (GIIS DXB, GIISAUH, EASCHOOLSHJ, GIS-DXB, EASCHOOL, GLOBALSA).

10 - HRMS (1.8 GB). Human Resources Management System data. 156,964 employee attendance records. Leave balances. 2,311 reporting line records with named managers. 2,916 HR files from the gsg-hrms S3 bucket.

11 - User Photos (62 MB). Staff and user profile photographs from the gsg-users S3 bucket.

Finally, we’d like to direct your attention to the CEO and founder of this institution: Mr Atul Temurnikar. This is the man who is directly responsible for this disaster. The man whose mic appears to have been swallowed by his bloated face.




We strongly suspect that he is the individual we were negotiating with, or if not, he was at least directly involved in the negotiations. At one point we sent Mr Temurnikar an email requesting the negotiator be replaced, as his combination of arrogance, immaturity and idiocy was going to lead to a disastrous outcome. 

And what a surprise, that disaster came to pass.

We hope the takeaway from all of this is a clear one: If you cannot afford to protect your students' data, you cannot afford to collect it.

We look forward to watching the tsunami of lawsuits Global Schools will be hit with imminently.

thankx..

[xjrjackblack]

thank you great share

[oylmkiog]

Well done!

[vanhelsing27]

Küresel Okullar / GIIS / GSG Sızıntıları

66 farklı uyruğa ait çocuklara ve ebeveynlerine ait 33.088 pasaport numarası • 2006-2024 yılları arasında kaydedilen 9,4 milyon dahili mesaj • 221 milyon öğrenci devam kaydı • 143.494 çalışan maaş kaydı • Ev adresleri ve GPS koordinatları bulunan 107.603 ulaşım kullanıcısı • 12.303 öğretmen şifresi (%99,98'i "giis123") • Tıbbi kayıtlar, kimlik belgeleri ve karne notları dahil 616.724 e-posta eki • 12.476 pasaport fotokopisi içeren 46.901 iş başvuru dosyası • 22.996 kampüs ziyaretçisi fotoğrafı • 112 kaynak kod deposu • 168 AWS Secrets Manager girişi • Ağustos 2022'den kalma bir fidye yazılımı saldırısının kanıtı

Not: Bu yayındaki tüm dosyalarda çocukların isimleri gizlenmiştir. Gizlenmemiş kopyalar öğrencilere ve ailelerine gönderilmiştir.

Global Indian International School (GIIS), Singapur merkezli ve K-12 eğitim holding şirketi olan Global Schools Foundation'ın (şirket içinde GSG olarak bilinir) amiral gemisi markasıdır. Şirket, Hindistan, BAE, Malezya, Japonya, Vietnam ve Suudi Arabistan'da dört okul markası (GIIS, OWIS, Glendale, East Academy) işletmektedir. GSG, yaklaşık 440 milyon Singapur doları sermaye yatırımı yapmış ve 1,5-2 milyar ABD doları tutarında ek okul satın alımları planladığını açıklayan Apollo Global Management tarafından desteklenmektedir.

70'ten fazla kampüsü bulunmaktadır. 7 ülkede on binlerce çocuğa hizmet vermektedir. Bir okulun tutabileceği en özel verilere sahiptir: pasaport numaraları, tıbbi kayıtlar, ruh sağlığı krizleri, ebeveynlerin gizli olduğuna inanarak gönderdiği aile iletişimleri.

Tüm bu veriler "giis123" şifresiyle korunmaktadır. Bu şifre, bulut ortamlarında varsayılan ve yeniden kullanılan kimlik bilgilerini kapsamaktadır. 2022'de otomatik bir fidye yazılımı saldırısına bile maruz kaldılar ve bunu asla fark etmediler, READ_ME_TO_RECOVER_YOUR_DATA fidye notunu asla temizlemediler.

Ama durum bundan da kötü; müzakerelerde şimdiye kadar gördüğümüz ve muhtemelen de göreceğimiz en absürt, mantıksız ve tamamen çılgınca davranışlarda bulundular. Eğer söz konusu olan kendi öğrencilerinin en hassas verileri olmasaydı, neredeyse komik olurdu.

GSG'nin AWS ortamına (hesap 199031240001, ap-southeast-1) ilk erişimi Nisan 2026'nın başlarında sağladık. Şaşırtıcı bir şekilde, uzlaşmanın çok basit doğasına rağmen, bunu nasıl başardıklarını hala belirleyemediler, bu yüzden burada henüz açıklamak istemiyoruz.

Söyleyebileceğimiz şey, orada bulduklarımız. AWS hesaplarının karmakarışık yapısında 67 S3 kovası. Beş canlı MSSQL sunucusu, hepsine aynı kimlik bilgileriyle erişilebiliyor, sıfır erişim kontrolü: VPC yok, güvenlik duvarı yok. 2022'de belirlenen kimlik bilgilerini hala kullanan dört MongoDB sunucusu. AWS Secrets Manager'da 168 gizli bilgi, çünkü elbette her şey için kök AWS hesaplarını kullanıyorlardı.

Öğretmen/personel kimlik doğrulama veritabanı - her kampüste öğrenci kayıtlarına, veli iletişimine ve yönetim araçlarına erişimi kontrol eden sistem - 12.303 şifreyi düz metin olarak saklıyordu. Karma değil. Şifrelenmemiş. Düz metin. Ve bu şifrelerin 12.301'i aynıydı: giis123. Kalan ikisi giis1234 ve shail110 idi.

Bir hafta içinde 4,8 terabayt veri sızdırdık. Kimse fark etmedi. Onlarla iletişime geçmeseydik, muhtemelen asla fark etmezlerdi.

---

YILLARCA SÜREN İHMAL

Bu, GSG'nin ilk ihlali değildi. Bu, onlar için açıkça gösterilmiş bir ihmal örneğidir.

Hem 13.250.47.35 hem de 13.212.148.158 adreslerindeki MongoDB sunucularında, dört özdeş fidye notu içeren READ_ME_TO_RECOVER_YOUR_DATA adlı bir veritabanı bulduk. ObjectID zaman damgaları 5-9 Ağustos 2022 tarihlerine karşılık geliyor. Daha önceki bir saldırgan, yaklaşık dört yıl önce bu sunucuları ele geçirmiş, veritabanlarını kısmen silmiş ve fidye talepleri bırakmıştı. İletişim e-postaları: [email protected] ve [email protected]. BTC cüzdanı: 12nx7Q6FAczH6yfhaEMJRmvRkavDTcwUJK. (Acaba bu sizlerden biri mi?)

Fidye notu veritabanları hiçbir zaman temizlenmedi. Nisan 2026'da geldiğimizde hala oradaydılar. Belki de hiç fark edilmediler; saldırı açıkça otomatikleştirilmişti ve kritik verilere zarar vermemişlerdi. Ama yine de... MongoDB kimlik bilgileri (mongostage / stagemongodb@0, root / testmongodb0) 2022'de de geçerli olan aynı bilgilerdi. Test sunucusunun şifresi de tam olarak stagemongodb@0 idi.

GSG dört yıl önce saldırıya uğramıştı. Hiçbir önlem almadılar. Kimlik bilgilerini değiştirmediler. Kimseyi bilgilendirmediler. Fidye notlarını veritabanlarında sanki birer ödül gibi bıraktılar ve hiçbir şey olmamış gibi devam ettiler.

Bunun yerine, bu durumu kendilerine bildirdiğimizde, fidye notlarının varlığını, verileri silmek için belirlediğimiz bedeli ödememek için bir bahane olarak kullanmaya çalıştılar. Argümanları, daha önce de saldırıya uğradıkları, dolayısıyla verilerin zaten orada olduğu yönündeydi. Bu yaygın bir endişe, ancak bu özel durumda, apaçık saçma.

Saldırıya uğrayan iki veritabanı yalnızca birkaç gigabayt veri içeriyordu. Bulut fidye yazılımı saldırısı açıkça bir aptal tarafından gerçekleştirilen otomatik bir kampanyanın parçasıydı (sadece birkaç tabloyu sildi, önemli olanları bıraktı) - stagemongodb@0 gibi bilgi güvenliği başyapıtı olan son derece zayıf veya varsayılan kimlik bilgilerine sahip veritabanlarını hedef alan türden kitlesel bir saldırı.

Bize verilerinin istediğimiz paraya "değer olmadığını" söylediler. "İnsanların hafızası kısa" dediler.

Biz katılmıyoruz. 

Ve şimdi, kampüslerindeki yaklaşık 69.000 öğrencinin velisine e-posta gönderdiğimizden beri, anlamsız ve mantıksız bir ihtarname gönderdikleri noktaya kadar bir öfke dalgası almaya başladılar: https://fulcrum.st/gsg/ceasedesist.png

Bu oldukça komik, çünkü aptal müzakerecileri haftalarca bu verilerin ne kadar duyarsız olduğundan bahsetmişti. Sanırım fikirlerini değiştirdiler?

Her durumda, uymayı reddettik: https://fulcrum.st/gsg/GSlawyers2.png

VERİLER

Sizin için derlenmiş bir özet paketi oluşturduk. İşte dosya ağacı -- verilerin ayrıntılı haritası ve açıklaması için aşağıya bakın:

GSG_highlights/ 111 GB

01_internal_messages/ 9.6 GB
  GSG'nin özel posta sunucusundan alınan eksiksiz PG_Campus_Mails veritabanı.
  2006'dan beri tüm kampüslerdeki veli-öğretmen-yönetici mesajlarının tamamı.
    dbo.ICSMail.jsonl.gz 1,6 GB 8.584.247 mesaj (ana)
    dbo.ICSMail_bk_04122024.jsonl.gz 9.423.882 mesaj (yedek)
    dbo.ICSMail_13032025.jsonl.gz 8.539.414 mesaj (anlık görüntü)
    dbo.ICSMail_New.jsonl.gz 3.494.952 mesaj
    dbo.ICSMailDetail*.jsonl.gz 42.112.325 yönlendirme kaydı (kim kime gönderdi)
    + ekler, yayın e-postaları, ayarlar, bayraklar

02_student_databases/ 687 MB
  Temel kimlik veritabanları.
    ICSStuInfo_FULL_35938_STUDENTS.jsonl Sıkıştırılmış, görüntülenmeye hazır
      35.938 öğrenci kaydı, her biri 197 sütun
      14.908 öğrenci pasaportu, 8.977 baba pasaportu, 9.203 anne pasaportu
      Ev adresleri, işveren, gelir, sağlık durumları, din, kast
    TEACHER_PASSWORDS_PLAINTEXT_12303.jsonl Sıkıştırılmış, görüntülenmeye hazır
      12.303 hesap. 12.301 şifre = "giis123". Düz metin olarak.
    PG_Campus_Users/ 68 tablo
    PG_Campus_Teachers/ 24 tablo
    SITUsers.json Tüm kampüslerde 71.547 kullanıcı kaydı

03_applicants/ 92 GB
  gsf-career S3 kovasının tamamı. İş başvuru belgesi depolama alanı.
    Başvuru Belgeleri/ 46.901 ayrı klasör
      12.476 klasör pasaport taraması (JPG/PDF)
       6.139 klasör vize veya çalışma izni kopyaları
         142 klasör Aadhaar kartı (Hindistan biyometrik kimlik)
         163 klasör kredi kartı ekstresi
         153 klasör sağlık sertifikası
      20.881 klasör özgeçmiş/CV
    Bunlar taranmış gerçek belgelerdir -- pasaport biyometrik sayfaları, vize damgaları, devlet kimlik kartları.

04_ziyaretçi_fotoğrafları/ 2,3 GB
  GSG kampüsüne giren her kişinin 22.996 fotoğrafı.

05_çalışan_ücretlendirmesi/ 77 MB
    143.494 maaş kaydı
      8.416 Yıllık Toplam Ücret kaydı
     25.332 yönetici değerlendirmeli performans değerlendirmesi
     12.602 değişken ücret kaydı

06_kaynak_kodu/ 2,5 GB
  112 CodeCommit deposu. SmartLearn/MyGIIS platformunun tamamı.
  Arka uç (C#/.NET), ön uç (Angular/React), mobil (Android/iOS),
  altyapı (ArgoCD, IdentityService, GlobalLogin).
  Her yerde sabit kodlanmış kimlik bilgileri.

07_credentials/ 548 KB
    168 AWS Secrets Manager girişi
     19 benzersiz AWS erişim anahtarı çifti
     22 benzersiz SQL Server şifresi
     18 gömülü kimlik bilgileri içeren MongoDB bağlantı dizesi
     JWT imzalama anahtarları, AES-256 anahtarları + IV'ler, SMTP şifreleri,
     Twilio kimlik doğrulama belirteçleri, Google OAuth, Zoom OAuth, Firebase

08_mongodb/ 1.1 GB
  4 MongoDB sunucu dökümü. 43 JSON dosyası.
    107.603 ev adresli ulaşım kullanıcısı
    183.731 GPS koordinatlı günlük yolculuk katılım kaydı
     25.362 personel-veli mesajı
     13.195 sohbet dizisi
    268.968 yardım masası kullanıcı hesabı
    VERİLERİNİZİ KURTARMAK İÇİN OKUYUN (2022 fidye notları hala orada)

09_twilio_sms/ 1,5 GB
  Tam Twilio hesap dökümü -- üretim SMS sistemi.
    122.862 SMS mesajı (30 Nisan 2026'ya kadar)
     7 ülkede 34.708 benzersiz telefon numarası
      Ebeveyn telefonlarına bağlı 5.211 benzersiz öğrenci adı
    3 GSG'ye ait telefon numarası:
      +14243519626 (ABD), +601130115667 (MY), +6582410436 (SG)

10_hrms/ 1,8 GB
  Çalışan devamsızlık, izin, raporlama hatları, İK dosyaları.

11_user_photos/ 62 MB
  Personel ve kullanıcı profil fotoğrafları.


Öne çıkanları indirme bağlantıları:



Yakında sitemizde yayınlanacak olan 4,8 TB'lık tam indirme için sitemizi takip edin!


PASAPORT NUMARALARI - 66 UYRUKTAN 33.088 ÖĞRENCİ.

02_student_databases/ dizinindeki ICSStuInfo_FULL_35938_STUDENTS.jsonl dosyası sıkıştırılmış halden çıkarıldı ve açılmaya hazır. Her öğrenci için bir satır. Her satırda 197 alan. Pasaport sütunları Pasaport, Baba Pasaportu ve Anne Pasaportu olarak adlandırılmıştır. 14.908 öğrenci pasaportu. 8.977 baba pasaportu. 9.203 anne pasaportu. Hintli, Singapurlu, Birleşik Arap Emirlikleri vatandaşı, Çinli, Japon, Malezyalı, Amerikalı, İngiliz, Pakistanlı, Bangladeşli, Sri Lankalı, Avustralyalı, Koreli, Filipinli, İranlı, Myanmarlı: Toplam 66 uyruk.

Bu okullara çok tanınmış aileler gidiyor. Umarım bu durum, güvenlik ihlalinden haberdar olduktan sonra değişir, ancak şu anda bu aileler arasında şunlar yer alıyor: Özbekistan'ın Singapur Büyükelçisi (pasaport DA0006280, kızının pasaportu DA0006301, ev adresi: 18 Tanglin Walk, Tanglin Hill Condominium ). Bir Goldman Sachs İcra Direktörü (pasaport Z6208645, oğlunun pasaportu V1146894, ev: Blok 297, Punggol Central, #14-485). GIC Özel Yatırımlar Başkan Yardımcısı --Singapur'un 800 milyar dolarlık devlet varlık fonu (pasaport F7623934, oğlunun pasaportu H8673949, ev: 26 Bayshore Road, The Bayshore, #18-07 ). Tokyo'da 10.000.000 ¥ kazanan bir JPMorgan Chase Başkan Yardımcısı . Singapur pasaportu K0985142B olan bir Facebook/Meta Direktörü . Bir Kore Ordusu subayı. Dışişleri Bakanlığı'ndan bir Mısır diplomatı . 218 Standard Chartered Bank ailesi. 239 Tata Consultancy Services ailesi. 113 Accenture ailesi.

Bunlar kolayca iptal edilebilen kredi kartı numaraları değil. Bunlar çocuklara ve ailelerine ait devlet kimlik belgeleri. Bu uyrukların birçoğu için pasaport yenileme pahalı, yavaş ve bürokratik olarak zahmetli. Bazıları için, yaşamadıkları bir ülkedeki büyükelçiliği ziyaret etmeyi gerektiriyor. Ancak GSG'nin müzakerecisine göre bu aslında endişe kaynağı değil:



Gördünüz mü? Okullarına devam eden her öğrenci ve ailenin pasaport bilgilerini kaybetmek büyük bir sorun değil; hepsi 5-10 yıl içinde geçerliliğini yitirecek. Bu neredeyse hiç zaman değil. Tamamen önemsiz, tıpkı ebeveynlerin çocuklarının ruh sağlığı ve davranış sorunları hakkında yazdığı binlerce e-posta ve onlar için çalışan veya iş başvurusunda bulunan herkesin kimlik ve pasaport fotokopileri gibi.


9,4 MİLYON İÇ MESAJ (2006–2024)

PG_Campus_Mails veritabanının tamamı: neredeyse yirmi yıldır her GSG kampüsünde ebeveynler, öğretmenler, danışmanlar, koordinatörler ve yöneticiler arasında gönderilen her mesaj. Sadece ana tabloda 8.584.247 mesaj. Tam HTML gövdeleri, konular, gönderen kimlikleri, zaman damgaları. Her gönderici-alıcı ilişkisini haritalayan ~42 milyon yönlendirme kaydı.

Tüm veri kümesinde anahtar kelime aramaları yaptık ve aşağıdakileri doğruladık:

- Belirli rahatsızlıkları olan belirli çocukları adlandıran 14.236 tıbbi açıklama
- Saldırganları ve mağdurları adlandıran 2.115 zorbalık raporu
- 4.242 olay raporu (adı geçen öğrenciler arasında fiziksel kavgalar)
- 1.064 disiplin işlemi (hırsızlık, kötü davranış, uyarı kartları)
- Fiziksel ve cinsel taciz dahil 170 taciz şikayeti
- 550 kaza raporu
- Adı geçen çocuklar hakkında velilere gönderilen 271 uyarı mektubu
- Öğretmenlerden gelen ve bireysel maaşlarını açıklayan 618 maaş şikayeti ("maaşım 3200")
- Kişisel durumları içeren 410 istifa mektubu
- 70 intihar referansı
- 37 kendine zarar verme açıklaması
- Gönderenler tarafından açıkça gizli olarak işaretlenmiş 184 mesaj. Bunların bir örneğini sitemizdeki gönderinin 

altındaki ekte bulabilirsiniz - gidip bir göz atın. GSG bunları "önemsiz" olarak değerlendirdi. Biz katılmıyoruz.[url=https://fulcrum.st/gsg/][/url]

Ebeveynler bu mesajları güvenle gönderiyorlar. Çocuklarının öğretmenine intihar girişimi, panik atak, zorbalık olayı, istismar ifşası gibi konularda yazıyorlar ve bu iletişimin gizli olduğuna inanıyorlar. GSG, tüm bunları on sekiz yıl boyunca tek bir veritabanında, tek bir şifreyle, şifreleme olmadan sakladı.

E-posta veritabanlarından binlerce son derece hassas iletişimi çıkardık. Aşağıda birkaç örnek bulunmaktadır. Öğrencilerin isimlerini gizledik, çünkü GSG'nin aksine, çocukların güvenliğini önemsiyoruz.

Singapur'da bir okul müdürü, bir veliye şöyle yazıyor: "Önceki gece aşırı dozda İbuprofen aldığını ve ayrıca reçeteli psikiyatrik ilaçlarını (işaretsiz bir şişede 23 tablet) yanında bulundurduğunu söyledi. Bir haftadır kendine zarar verme duyguları yaşadığını belirtti. Okula gelmenizi beklerken, dürtüsel olarak revirde öksürük şurubu da içti."

Singapur'da bir okul danışmanı: "İntihar düşüncesi taşıdığını ve kafasının içindeki birinin ona zararlı şeyler yapmasını söylediğini ısrarla belirtti. Hatta örneğin, yoldan geçerken arabanın önüne atlamak gibi örnekler bile verdi. [GİZLİ] ve arkadaşları son iki üç haftadır benimle iletişime geçerek intihar düşüncelerinden açıkça bahsediyorlardı."

Kızının hastaneye kaldırılmasıyla ilgili yazan bir veli: "[GİZLİ]'nin intihar düşüncesi taşıdığı iddiaları nedeniyle gözlem altında tutulmak üzere hastaneye yatırıldığını bildirmek isterim."

Bangalore'da bir öğretmen: "Bugün öğle arası sırasında [GİZLİ], bıçak bileme aletinden bıçağı çıkarıp kendine zarar vermeye çalıştı. Elinde birkaç çizik var."

Bir öğretmenin anekdot kaydı: "[GİZLİ] giderek artan bir şekilde intihar ve depresyondan bahsediyor ve sık sık 'Kendimi kesmek istiyorum', 'Ölümümü taklit etmek istiyorum', 'İnsanların beni önemseyip önemsemediğini görmek için yüksekten atlamak istiyorum' gibi ifadeler kullandığı duyuluyor." Bu ifadelerin sıklığı ve yoğunluğu endişe verici."

Singapur kampüsünden bir veli: "Kızım, ellerini ve boğazını kesmek de dahil olmak üzere kendine zarar vermeyi düşündüğünü belirtti. Bu son derece endişe verici bir durum."

Singapur'da kızının sınıfındaki başka bir çocuk hakkında yazan bir veli: "Okul kantininde bileğini çatalla kesmeye çalıştı."

Dubai'den bir veli: "Kızım okulda maruz kaldığı zorbalık nedeniyle ağır depresyona girdi. Geçen yılın Haziran ayından beri okula neler olduğunu bildiriyorum. [...] Okul hiçbir şey yapmadı. Bu, kızımı kendine zarar verecek noktaya kadar depresyona sürükledi."

Tokyo'da altı yaşındaki kızı hakkında gayet sakin bir şekilde yazan bir anne: "Sınıf arkadaşları tarafından tekmelenmesine, taciz edilmesine ve istismara uğramasına rağmen, Bayan Priyanka sayesinde olduğuna inanıyorum,"Okula hiç devamsızlık yapmıyor."

Binlerce örnek daha var. 

Bu çocuklar okullarına güvendiler. Ebeveynleri de okullarına güvendiler. GSG, aşırı doz, kendine zarar verme, intihar düşüncesi, istismar, psikiyatri hastanelerine yatış gibi en savunmasız anlarını, kuruluştaki her öğretmenin erişebileceği giis123 şifresiyle erişilebilen bir veritabanında sakladı.


ULAŞIM VE FİZİKSEL TAKİP

107.603 ulaşım kullanıcı kaydı, ikamet adresleri, doğum tarihleri ve telefon numaralarıyla birlikte. Çocukların ne zaman alınıp bırakıldığını gösteren 183.731 günlük yolculuk katılım kaydı. GPS koordinatlarına sahip 1.925 otobüs durağı. 1.079 otobüs güzergahı.

Her öğrencinin her kampüste ne zaman mevcut veya devamsız olduğunu takip eden 221 milyon öğrenci katılım kaydıyla birlikte, bu veriler yedi ülkede on binlerce çocuğun günlük fiziksel hareketlerini yeniden oluşturuyor.

ÇALIŞAN VERİLERİ

143.494 yıllık toplam ücret (CTC) değerleriyle maaş kaydı. Yönetici değerlendirmeleri ve yorumlarıyla 25.332 performans değerlendirme kaydı. 12.602 değişken ücret kaydı. Giriş/çıkış saatleri ve kampüs konumları dahil 156.964 İKYS devam kaydı. Adlandırılmış yöneticilerle birlikte 2.311 raporlama hattı kaydı. Eksiksiz organizasyon hiyerarşisi. Maaş miktarları, alt kademe öğretmenler için aylık 3.200 SGD'den, üst düzey yöneticiler için yıllık 350.000 SGD'nin üzerine kadar değişmektedir.

İŞ BAŞVURUCULARI

03_applicants/ klasöründe 46.901 başvuru dosyası bulunmaktadır. Bunlar pasaport fotokopileri, çalışma izni fotokopileri, Hindistan Aadhaar biyometrik kimlik kartları içermektedir. 163 dosya kredi kartı ekstresi içermektedir. 153 dosya sağlık sertifikası içermektedir.


DİĞER HER ŞEY

- 14 kampüste 22.996 kampüs ziyaretçisi fotoğrafı 
- Karne, pasaport ve NRIC numaraları içeren kimlik belgeleri, devlet kimlikleriyle birlikte sağlık sertifikaları dahil 616.724 e-posta eki (254 GB)
- 34.708 benzersiz telefon numarasına 122.862 Twilio SMS mesajı -- GSG'nin kendi telefon numaraları, markalı BAE gönderici kimlikleri dahil (GIIS DXB, GIISAUH, EASCHOOLSHJ, GIS-DXB, GLOBALSA)
- 112 CodeCommit kaynak kod deposu -- Sabit kodlanmış AWS anahtarlarıyla eksiksiz SmartLearn platformu

---

DÜNYANIN EN APTAL MÜZAKERECİLERİ

Normalde ihlal edilen şirketlerle olan yazışmalarımızı yayınlamıyoruz. Bunu daha önce sadece bir kez, gönderilerimizi kaldırdıktan sonra bize ihtiyati tedbir kararı veren youX ile yaptık. Ancak GSG'nin davranışı o kadar olağanüstüydü ki - o kadar dürüst olmayan, o kadar aptalca, her şirketin (onlar hariç) son derece ciddiye aldığı sürece o kadar saygısızcaydı ki - bir istisna yapıyoruz.

Mayıs ayı başlarında GSG ile iletişime geçtik ve onlara 750.000 dolarlık adil bir uzlaşma teklif ettik. Bağlam açısından, istediğimiz miktar, Singapur kampüslerindeki bir sınıf dolusu öğrencinin bir yıllık öğrenim ücretinden bile azdı. Apollo'nun taahhüt ettiği sermayenin %0,17'siydi. Herhangi bir ölçüye göre, GSG'nin şu anda karşı karşıya olduğu düzenleyici ve yasal riskin çok küçük bir kısmıydı.

GSG'nin cevabı yalan söylemek oldu. Tekrar tekrar. Her şey hakkında.

YALAN #1: "ŞUBELERİMİZİN ÇOĞU FRANCHISE'DIR"

GSG, kampüslerinin şirket mülkiyetinde değil, bağımsız franchise'lar olduğunu iddia etti. Bu yanlıştı. Temmuz 2023'te kendi basın bültenlerinde Apollo'nun taahhüdünü neredeyse ikiye katlayarak 440 milyon Singapur dolarına çıkardığını, "650 milyon ABD dolarının üzerinde" yatırım ve "25'ten fazla satın alma" gerçekleştirdiğini duyurdular - bu da "tamamen satın alma" olarak tanımlandı. Dwight School Seoul, Glendale Academy Hyderabad, Silveroaks Bangalore, Regent International Malaysia. Tamamen satın almalar. Franchise anlaşmaları değil. Bu gerçeği çok açık bir şekilde ortaya koyan düzinelerce makale ve duyuru var.

Franchise modeli yıllar önce sona erdi. GIIS Chinchwad, franchise süresi dolduğunda Elpro International School oldu. GIIS Dubai'nin orijinal ortağı Scoreplus Education, 2012'de GSG'den ayrıldı. GIIS Surat kapandı. Bunların hepsini ortaya koyduk. GSG'nin müzakerecisi kafa karıştırıcı ve aptalca bir şekilde karşılık verdi ve fiyatı düşürme girişimlerinde başka bir açıya geçti.

YALAN #2: "SHINYHUNTERS BİZİ ŞANTAJ EDİYOR"

GSG başlangıçta ShinyHunters'ın daha önce aynı verileri aldığını ve onları şantaj ettiğini iddia etti. ShinyHunters'ın "tüm veritabanını onlara gösterdiğini" (sanki bizim aldığımız tek bir veritabanıymış gibi) ve bu nedenle "onların elinde olduğunu bildiklerini", bizim aksimize söylediler. Bunu sormak için doğrudan ShinyHunters ile iletişime geçtik. Onlardan hiç haberleri olmadığını söylediler.



Bunu ilettiğimizde, GSG hiç tereddüt etmedi; ShinyHunters'ı isimsiz "diğer gruplarla" değiştirdiler - uygun bir şekilde doğrulanamaz.

Ama tamam, diye düşündük. Berbat güvenlikleriyle, birden fazla saldırganın örtüşen verilere ulaşması imkansız değildi. Belki de verilerin, ihlallerin ve veri ihlallerinin nasıl işlediği konusunda kafaları karışmıştı. Bunu aldatmacadan ziyade cehalete bağlamaya hazırdık.

Ama bu, ne tür sapık patolojik yalancılarla uğraştığımızı anlamadan önceydi.

YALAN #3: "VERİLERİN %99'UNDAN FAZLASI ZATEN KARANLIK AĞDA VAR YA DA BEN ELE GEÇİRİLDİM"

Bu iddiayı yukarıdaki ekran görüntüsünde görebilirsiniz. Bu iddiayı tekrar tekrar dile getirdiler ki bu tuhaf, çünkü HIBP'ye abone olmak bile bunun tamamen ve kesinlikle yanlış olduğunu görmek için yeterli. Bazı e-postalar orada, doğru, çünkü gerçek şu ki herkesin e-postası birden fazla veri ihlalinde yer aldı. Ama hepsi bu: sadece e-postalar. Belki birkaç adres, ama biz bulamadık. Kesinlikle mevcut olmayanlar: öğrencilerinin veya velilerinin tek bir pasaport numarası, başvuru sahiplerinin tek bir devlet kimlik kartı ve elbette, öğrencilerinin en kişisel sorunlarını tartışan tek bir hassas e-posta.

YALAN #4: UYDURMA KARANLIK AĞ LİSTESİ

İşte işler burada gerçekten çılgınlaşıyor.

GSG'nin müzakerecisi bize, "LedgerWraith" adlı bir kullanıcı tarafından verilerimizin 250.000 dolara satıldığını iddia eden bir karanlık web forum gönderisinin ekran görüntüsünü gönderdi. "CloudSec" adlı bir izleme servisi tarafından keşfedildiğini iddia ettiler.



İlan sahte idi. İçindeki her rakam - 4,8 TB, 35.938 öğrenci kaydı, 33.000 pasaport numarası, 9,4 milyon mesaj, 221 milyon devam kaydı, 143.000 maaş kaydı - GSG ile yaptığımız kendi iletişimlerimizden doğrudan kopyalanmıştı. Tam olarak aynı, yinelenen verilerden arındırılmış rakamlar. Başka bir aktörün tam olarak bizim sahip olduğumuz hizmetlere erişim sağlamış olsa bile, biz bunu kendine özgü bir şekilde yinelenen verilerden arındırıp nicelendirdik. Tek bir veri kaynağı için bile aynı rakamlara sahip olma olasılıkları neredeyse sıfır, tüm veri kaynakları için ise hiç yok. Ayrıca, kullanılan dil de onlara gönderdiğimiz e-postaları taklit ediyordu. "Kapsam doğrulaması için rastgele dosya seçimi desteklenir" ifadesi, doğrulama teklifimizden alınmıştır.

Ayrıca, görünüşe göre yapay zekaya sızıntı gönderilerimizden birkaçını da yedirmişler, çünkü bazı biçimlendirmeler sitemizdeki kendi yazılarımızın kötü, anlamsız ve utanç verici taklitleri gibi görünüyor. Özellikle, aptalca emojilerle çevrelenmiş "Merkezileştirilmiş demek tek tuş, her şey demektir. Gelen kutusu ön kapıydı" cümlesi, yapay zeka tarafından üretilen en utanç verici şeylerden biri. Bunu, sanki biz yazmışız gibi bizi ikna etmek için ciddi bir yüz ifadesiyle kullanmaları akıl almaz.

Dahası, burada yazanların da bileceği gibi, yeraltı piyasa ekosistemini bilenler fiyatın absürt olduğunu fark edeceklerdir: "karanlık web forumunda" okul verileri için "başlangıç teklifi" olarak 250.000 dolar - bu tür veriler asla bu fiyata satılmaz. Nokta. Bu fiyatın %10'u bile değil. Belki %5'i. Karşılaştırma yapmak gerekirse, yakın zamanda TeamPCP'nin Eli Lilly'nin tüm kaynak kodunu (~1400 GitHub deposu) 70.000 dolara satışa çıkardığını gördük. Ve bu, şimdiye kadar gördüğümüz en yüksek fiyatlardan biri. 250.000 dolar tam olarak göründüğü gibi, bir LLM tarafından hayal edilen ve doğru düzgün yalan söylemeye bile zahmet etmeyen aptallar tarafından kullanılan uydurma bir rakam.

"LedgerWraith" hesabı hiçbir karanlık web forumunda mevcut değil. "CloudSec" izleme hizmeti karanlık web izleme yapmıyor; GSG ile hiçbir ilişkisi olmayan Taylandlı bir sızma testi firması. GSG'nin Tayland'da bile faaliyet göstermediği biliniyor. Başka bir deyişle, bulut güvenliği şirketi gibi geldiği için bu ismi uydurdular: CloudSec. Harika.

GSG, kendi yazışmalarımızla beslenen bir yapay zekâ sohbet robotu kullanarak karanlık web'de sahte bir ilan oluşturdu, bunu kurgusal bir satıcıya atfetti ve bize gönderdi; amaçları 1) onlara inanmamız ve 2) iddia edilen satışın daha düşük bir fiyata yol açmasıydı. Onların argümanı şuydu: Kendi üyeleriniz satıyorsa neden para ödeyesiniz ki? Tıpkı "ShinyHunters veya başkaları da satıyorsa neden para ödeyesiniz ki?" argümanları gibi.

Bu, abartısız, bu iş kolunda karşılaştığımız en aptalca şey. Ve biz bununla çok karşılaşıyoruz. Ancak bu anlamsız öz-sabote etme düzeyi gerçekten de bir sonraki seviye aptallık. Bunun fiyatı düşürmemizi sağlayacak başarılı bir taktik olacağını düşünmeleri, bir okul zincirini nasıl yönettiklerini merak etmemize neden oluyor.

Bunlar en iyiler ve en zekiler değil. Gönderdikleri sahte ilanla ilgili yüzlerce kırmızı bayrak yokmuş gibi -ki bu tür satış ilanları veya kullanıcılar hiçbir yeraltı forumunda bulunmuyor- sahte ilanın iki sözde "ekran görüntüsü" arasındaki ayrıntıları bile doğru ayarlayamadılar. Buraya ekleyebileceğimiz resim sayısı sınırlı, bu yüzden sitemizdeki gönderiye bakın, ancak sahteciliği bile tutarlı tutamadılar.

SONRASI

GSG'yi uydurma "kanıtları" konusunda sorguladığımızda, yanıtları bunun sahte olduğunu iddia edeceğimizi bildiklerini söylemek ve sözde "satışı" silme işleminin tam bedelini ödememek için bir gerekçe olarak kullanmak oldu - ki bu baştan beri planladıkları şeydi.

Ardından bize 100.000 dolar teklif ettiler. Yine. Ama o noktada, o kadar tiksinmiştik ki, hiçbir para onları bu durumdan kurtaramazdı. Sahte gönderi çok ileri bir adımdı ve bunu kullanarak ve yalanı ikiye katlayarak, herhangi bir uzlaşma şansını baltaladılar ve kendilerini sonuçlarıyla yüzleşmeye mahkum ettiler.



Tüm bu olaylar zincirine inanmakta zorlanıyoruz. 33.000 çocuğun pasaport numarasına, intihar girişimlerini ve kendine zarar verme davranışlarını belgeleyen ruh sağlığı kayıtlarına ve 9,4 milyon özel veli-öğretmen iletişimine sahip olan ve Apollo sermayesiyle 440 milyon dolar desteklenen bir okula, bu durumu nispeten düşük bir maliyetle çözme şansı sunuldu; ancak okul bunun yerine kanıt uydurmayı, kurumsal yapısı hakkında yalan söylemeyi, hayali tehdit aktörleri icat etmeyi ve Have I Been Pwned gibi veri sızıntısı/karanlık web izleme sitelerinde verilerin varlığını tamamen kurgusal hale getirmeyi seçti.

BUGÜN YAYINLADIĞIMIZ ŞEY -- ÖNE ÇIKANLAR PAKETİNİN DETAYLI HARİTASI

111 GB'lık derlenmiş bir öne çıkanlar paketi yayınlıyoruz. 4,8 TB'lık tam veri dökümü yakında yayınlanacak.

Çocukların isimleri tamamen gizlenmiştir. Bunu GSG'nin iyiliği için değil, onlara rağmen yapıyoruz. Bunların hiçbirini yayınlamaktan zevk almıyoruz. Bunu yapıyoruz çünkü ebeveynlerin okullarının neleri ifşa etmesine izin verdiğini ve bunun nasıl "korunduğunu" (eğer buna koruma denebilirse) bilme hakkına sahip olduğuna inanıyoruz.

Veri setinin tamamını ve sansürsüz halini şu kişilerle paylaşacağız:

- İhlali araştıran doğrulanmış gazeteciler
- Singapur Kişisel Veri Koruma Komisyonu, Hindistan Veri Koruma Kurumu ve BAE veri koruma ofisi
- Etkilenen aileleri temsil eden avukatlar
- Doğrulanmış araştırmacılar

Bir kopyasını almak isterseniz, bize [email protected] adresine (şirket alan adınızı kullanarak) bir e-posta gönderin.

Paket şunları içerir:

01 - Dahili Mesajlar (9,6 GB). GSG'nin özel posta sunucusundan alınan eksiksiz PG_Campus_Mails veritabanı. 2006'dan beri her kampüste veliler, öğretmenler, danışmanlar ve yöneticiler arasında gönderilen her mesaj. Ana tabloda 8,5 milyon mesaj, adli karşılaştırmayı sağlayan birden fazla zamansal anlık görüntü (Aralık 2024 yedeklemesi, Mart 2025 anlık görüntüsü). Her gönderici-alıcı ilişkisini eşleyen 42 milyon yönlendirme kaydı. S3 URL'leri içeren 3.489 posta eki kaydı. İntihar bildirimleri, zorbalık raporları, maaş şikayetleri, taciz şikayetleri ve gizli olarak işaretlenmiş mesajlar burada bulunur.

02 - Öğrenci Veritabanları (687 MB). Tüm GSG kampüslerindeki her öğrenci, veli ve öğretmen için temel kimlik veritabanları. En önemli dosya, sıkıştırılmış halden çıkarılmış, her satırda bir öğrenci bulunan, 197 sütunlu ve herhangi bir metin düzenleyicide açılmaya hazır ICSStuInfo_FULL_35938_STUDENTS.jsonl dosyasıdır. 35.938 öğrenci, 33.088 pasaport numarası (öğrenci, baba, anne). Blok/ünite/posta koduyla ev adresleri. Her iki ebeveynin işverenleri, pozisyonları ve gelir dilimleri. Sağlık durumları, din, kast, acil durum iletişim bilgileri. Ayrıca, şifreleri düz metin olarak saklanan 12.303 öğretmen hesabı da içerir - bunların 12.301'i giis123 şifresidir - TEACHER_PASSWORDS_PLAINTEXT_12303.jsonl olarak sıkıştırılmış halden çıkarılmıştır. Ayrıca, tüm kampüsleri ve markaları kapsayan 71.547 kayıtlık SITUsers.json kullanıcı dizini de mevcuttur.

03 - Başvuru Belgeleri (92 GB). gsf-career S3 kovasının tamamı. 46.901 ayrı klasör, her iş başvuru sahibi için bir tane. Bunlar veritabanı kayıtları değil; taranmış belgelerdir. Pasaport biyografik sayfalarının, vize damgalarının ve devlet tarafından verilen kimlik kartlarının fotoğrafları. 12.476 klasör pasaport taramaları içeriyor. 6.139 klasör vize veya çalışma izni kopyaları içeriyor. 142 klasör Aadhaar kartları (Hindistan biyometrik ulusal kimlik kartı) içeriyor. 163 klasör kredi kartı ekstreleri içeriyor. 153 klasör sağlık sertifikaları içeriyor. Hindistanlı başvuru sahiplerine ek olarak, Kore, Amerika, İngiltere, Japonya ve Avustralya vatandaşları da etkileniyor. Bu, paketin boyut olarak en büyük bileşenidir.

04 - Ziyaretçi Fotoğrafları (2,3 GB). GSG kampüsüne fiziksel olarak giren her kişinin (ebeveynler, ziyaretçiler, teslimat personeli, yükleniciler) 22.996 fotoğrafı. Her biri, ad, telefon, e-posta, devlet kimliği, ziyaret amacı ve kara liste durumuyla ilgili bir ziyaretçi kaydına bağlıdır.

05 - Çalışan Tazminatı (77 MB). Tüm kampüslerdeki her GSG çalışanı için eksiksiz maaş ve performans verileri. Her maaş kalemi için ayrı ayrı tutarları içeren 143.494 maaş kaydı. 8.416 yıllık toplam ücret kaydı. Yönetici değerlendirmeleri, yorumları ve hedefleri içeren 25.332 performans değerlendirmesi. Artış yüzdeleriyle birlikte 12.602 değişken ücret kaydı. 957 performans yönetim sistemi (PMS) Excel dosyası ve 25 insan kaynakları mektubu. Maaş tutarları, kıdemli olmayan öğretmenler için aylık 3.200 SGD'den, liderlik pozisyonları için yıllık 350.000 SGD'nin üzerine kadar değişmektedir.

06 - Kaynak Kod (2,5 GB). SmartLearn/MyGIIS platformunun tamamını oluşturan 112 CodeCommit deposu -- arka uç (C#/.NET), ön uç (Angular/React), mobil (Android/iOS) ve altyapı (ArgoCD, IdentityService, GlobalLogin). Her yerde sabit kodlanmış kimlik bilgileri: Herhangi bir tarayıcı tarafından görülebilen Angular ortam dosyalarındaki AWS erişim anahtarları, Encrypt=false ile veritabanı bağlantı dizeleri, JWT imzalama anahtarları, AES-256 şifreleme anahtarları.

07 - Kimlik Bilgileri (548 KB). Tam AWS Secrets Manager dökümü. Tüm ortamlardaki her mikro hizmeti kapsayan 168 giriş. Bunlar şu anda döndürülüyor -- onlarla iletişime geçtikten sonra birkaç hafta sürdü -- ancak maruz kalınan bilgilerin boyutunu göstermek istiyoruz.

08 - MongoDB (1,1 GB). 4 MongoDB sunucusundan dökümler. Ev adresleriyle 107.603 ulaşım kullanıcısı. GPS koordinatlarıyla 183.731 günlük yolculuk kaydı. 1.925 otobüs durağı, 1.079 güzergah. 25.362 personel-veli mesajı. 13.195 sohbet dizisi. 268.968 yardım masası hesabı. Ve READ_ME_TO_RECOVER_YOUR_DATA -- 2022 fidye notları, dört yıl sonra hala orada duruyor.

09 - Twilio SMS (1,5 GB). Tam üretim Twilio hesap dökümü. Nisan 2026'ya kadar 122.862 SMS mesajı. 7 ülkede 34.708 benzersiz telefon numarası. Veli telefonlarına bağlı 5.211 benzersiz öğrenci adı. GSG'nin 3 adet kendi telefon numarası (+14243519626 ABD, +601130115667 Malezya, +6582410436 Singapur) ve 6 adet markalı BAE gönderici kimliği (GIIS DXB, GIISAUH, EASCHOOLSHJ, GIS-DXB, EASCHOOL, GLOBALSA).

10 - İK Yönetim Sistemi (1,8 GB). İnsan Kaynakları Yönetim Sistemi verileri. 156.964 çalışan devam kaydı. İzin bakiyeleri. Adı geçen yöneticilerle birlikte 2.311 raporlama hattı kaydı. gsg-hrms S3 klasöründen 2.916 İK dosyası.

11 - Kullanıcı Fotoğrafları (62 MB). gsg-users S3 klasöründen personel ve kullanıcı profili fotoğrafları.

Son olarak, dikkatinizi bu kurumun CEO'su ve kurucusu Sayın Atul Temurnikar'a çekmek istiyoruz. Bu felaketten doğrudan sorumlu olan kişi odur. Şişmiş yüzünün mikrofonu yutmuş gibi görünen adam.




Onunla müzakere ettiğimiz kişiden şüpheleniyoruz, ya da değilse bile en azından müzakerelere doğrudan dahil olmuştu. Bir noktada Bay Temurnikar'a, kibir, olgunlaşmamışlık ve aptallığının felaketle sonuçlanacağını belirterek müzakerecinin değiştirilmesini talep eden bir e-posta gönderdik. 

Ve ne sürpriz, o felaket gerçekleşti.

Tüm bunlardan çıkarılacak dersin açık olduğunu umuyoruz: Öğrencilerinizin verilerini koruyamıyorsanız, onları toplayamazsınız.

Global Schools'un yakında maruz kalacağı dava tsunamisini izlemeyi dört gözle bekliyoruz.

Thx bro

[Elote_Savant]

Thanks

[heartlesspeople]

thanks bro

[LeakHunter_42]

The Global Schools / GIIS / GSG Leaks

33,088 passport numbers belonging to children and their parents across 66 nationalities • 9.4 million internal messages spanning 2006–2024 • 221 million student attendance records • 143,494 employee salary records • 107,603 transport users with home addresses and GPS coordinates • 12,303 teacher passwords (99.98% of which were "giis123") • 616,724 email attachments including medical records, identity documents, and report cards • 46,901 job applicant folders with 12,476 passport copies • 22,996 campus visitor photographs • 112 source code repositories • 168 AWS Secrets Manager entries • evidence of a prior ransomware attack from August 2022

Note: All children's names have been redacted across every file in this release. Unredacted copies were sent to students and their families.

Global Indian International School (GIIS) is the flagship brand of Global Schools Foundation -- known internally as GSG -- a K-12 education holding company headquartered in Singapore operating four school brands (GIIS, OWIS, Glendale, East Academy) across India, the UAE, Malaysia, Japan, Vietnam, and Saudi Arabia. GSG is backed by Apollo Global Management, which has committed approximately S$440 million in capital and described its plans to deploy US$1.5–2 billion in further school acquisitions.

They run 70+ campuses. They serve tens of thousands of children across 7 countries. They hold the most intimate data a school can hold: passport numbers, medical records, mental health crises, family communications that parents send in confidence believing they are private.

All of it was protected by the password "giis123". Default and reused credentials across their cloud environments. They were even hit by an automated ransomware attack in 2022 and never noticed, never cleaned up the READ_ME_TO_RECOVER_YOUR_DATA ransom note.

But it's even worse than that; they also engaged in the most absurd, illogical, and flat-out insane behaviour we have ever seen in negotiations, and likely ever will. It would almost be comical if the stakes weren't their own students' most sensitive data.

We gained initial access to GSG's AWS environment (account 199031240001, ap-southeast-1) in early April 2026. Shockingly, they still have not determined how, despite the very basic nature of the compromise, so we don't want to give it away here yet.

What we can say is what we found there. 67 S3 buckets across their mess of an AWS account. Five live MSSQL servers, all accessible with the same credentials, zero access controls: no VPC, no firewalls. Four MongoDB servers still running the credentials set in 2022. 168 secrets in AWS Secrets Manager, because of course they were using their root AWS account for literally everything.

The teacher/staff authentication database -- the system that controlled access to student records, parent communications, and administrative tools across every campus -- stored 12,303 passwords in plaintext. Not hashed. Not encrypted. Plaintext. And 12,301 of those passwords were identical: giis123. The remaining two were giis1234 and shail110.

We exfiltrated 4.8 terabytes over a week. Nobody noticed. If we hadn't contacted them, they probably never would have.

---

YEARS OF NEGLIGENCE

This was not GSG's first breach. This is a clearly demonstrated pattern of negligence for them.

On both MongoDB servers -- 13.250.47.35 and 13.212.148.158 -- we found a database named READ_ME_TO_RECOVER_YOUR_DATA containing four identical ransom notes. The ObjectID timestamps decode to August 5–9, 2022. A previous attacker compromised these servers nearly four years ago, partially wiped databases, and left ransom demands. Contact emails: [email protected] and [email protected]. BTC wallet: 12nx7Q6FAczH6yfhaEMJRmvRkavDTcwUJK. (Is this any of you guys lmao?)

The ransom note databases were never cleaned up. They were still there when we arrived in April 2026. Perhaps they were never noticed ; the attack was obviously automated and they didn't hit any critical data. But still. The MongoDB credentials -- mongostage / stagemongodb@0, root / testmongodb0 -- were the same ones valid in 2022. The staging server password was literally stagemongodb@0.

GSG was breached four years ago. They did not remediate. They did not rotate credentials. They did not notify anyone. They left the ransom notes sitting in their databases like participation trophies and carried on as if nothing had happened.

Instead, when we notified them of this fact, they tried to use the existence of the ransom notes as an excuse not to pay the price we named to delete the data. Their argument was they'd been breached before, so the data was out there. This is a common concern, but in this specific case, it is patently absurd.

The two databases that were breached contained only a few gigabytes of data. The cloud ransomware attempt was obviously part of an automated campaign (it wiped only a few tables, leaving the important ones) by an idiot -- the sort of mass exploitation that targets databases with extremely weak or default credentials, like the infosec masterwork that is stagemongodb@0.

They told us their data was "not worth" what we were asking. They said "people have short memory."

We disagree. 

And now, since we have emailed all ~69,000 parents of students across their campuses, they are beginning to receive a wave of outrage, to the point where they sent us a meaningless, senseless cease and desist: https://fulcrum.st/gsg/ceasedesist.png

Which is pretty funny, since their moronic negotiator had just spent weeks babbling about how insensitive all of this data was. Guess they changed their minds?

In any case, we declined to comply: https://fulcrum.st/gsg/GSlawyers2.png

THE DATA

We created a curate highlights pack for your viewing pleasure. Here's a file tree -- see further down for a detailed map and explanation of the data:

GSG_highlights/                                               111 GB

01_internal_messages/                                         9.6 GB
  Complete PG_Campus_Mails database from GSG's dedicated mail server.
  Every parent-teacher-administrator message across all campuses since 2006.
    dbo.ICSMail.jsonl.gz            1.6 GB    8,584,247 messages (main)
    dbo.ICSMail_bk_04122024.jsonl.gz            9,423,882 messages (backup)
    dbo.ICSMail_13032025.jsonl.gz               8,539,414 messages (snapshot)
    dbo.ICSMail_New.jsonl.gz                    3,494,952 messages
    dbo.ICSMailDetail*.jsonl.gz    42,112,325 routing records (who sent to whom)
    + attachments, broadcast mails, settings, flags

02_student_databases/                                         687 MB
  The core identity databases.
    ICSStuInfo_FULL_35938_STUDENTS.jsonl         DECOMPRESSED, READY TO VIEW
      35,938 student records, 197 columns each
      14,908 student passports, 8,977 father passports, 9,203 mother passports
      Home addresses, employer, income, medical conditions, religion, caste
    TEACHER_PASSWORDS_PLAINTEXT_12303.jsonl      DECOMPRESSED, READY TO VIEW
      12,303 accounts. 12,301 passwords = "giis123". In plaintext.
    PG_Campus_Users/                68 tables
    PG_Campus_Teachers/             24 tables
    SITUsers.json                   71,547 user records across all campuses

03_applicants/                                                 92 GB
  Complete gsf-career S3 bucket. Job applicant document storage.
    ApplicantDocuments/             46,901 individual folders
      12,476 folders with passport scans (JPG/PDF)
       6,139 folders with visa or work permit copies
         142 folders with Aadhaar cards (Indian biometric ID)
         163 folders with credit card statements
         153 folders with medical certificates
      20,881 folders with resumes/CVs
    These are the actual scanned documents -- passport bio pages, visa stamps, government identity cards.

04_visitor_photos/                                            2.3 GB
  22,996 photographs of every person who entered a GSG campus.

05_employee_compensation/                                      77 MB
    143,494 salary records
      8,416 Annual CTC records
     25,332 performance appraisals with manager ratings
     12,602 variable pay records

06_source_code/                                               2.5 GB
  112 CodeCommit repositories. Complete SmartLearn/MyGIIS platform.
  Backend (C#/.NET), frontend (Angular/React), mobile (Android/iOS),
  infrastructure (ArgoCD, IdentityService, GlobalLogin).
  Hardcoded credentials throughout.

07_credentials/                                               548 KB
    168 AWS Secrets Manager entries
     19 unique AWS access key pairs
     22 unique SQL Server passwords
     18 MongoDB connection strings with embedded credentials
     JWT signing keys, AES-256 keys + IVs, SMTP passwords,
     Twilio auth tokens, Google OAuth, Zoom OAuth, Firebase

08_mongodb/                                                   1.1 GB
  4 MongoDB server dumps. 43 JSON files.
    107,603 transport users with home addresses
    183,731 daily trip attendance records with GPS coordinates
     25,362 staff-parent messages
     13,195 chat threads
    268,968 helpdesk user accounts
    READ_ME_TO_RECOVER_YOUR_DATA   (the 2022 ransom notes, still there)

09_twilio_sms/                                                1.5 GB
  Complete Twilio account dump -- production SMS system.
    122,862 SMS messages (through April 30, 2026)
     34,708 unique phone numbers across 7 countries
      5,211 unique student names linked to parent phones
    3 GSG-owned phone numbers:
      +14243519626 (US), +601130115667 (MY), +6582410436 (SG)

10_hrms/                                                      1.8 GB
  Employee attendance, leave, reporting lines, HR files.

11_user_photos/                                                62 MB
  Staff and user profile photographs.


Links to download highlights:



Keep an eye on the post on our site for the full 4.8 TB download, coming soon!


PASSPORT NUMBERS - 33,088 ACROSS 66 NATIONALITIES

The ICSStuInfo_FULL_35938_STUDENTS.jsonl file in 02_student_databases/ is decompressed and ready to open. One line per student. 197 fields per line. The passport columns are called Passport, FthPassport, and MthPassport. 14,908 student passports. 8,977 father passports. 9,203 mother passports. Indian, Singaporean, Emirati, Chinese, Japanese, Malaysian, American, British, Pakistani, Bangladeshi, Sri Lankan, Australian, Korean, Filipino, Iranian, Myanmar : 66 nationalities in total.

Some very prominent families go to these schools. Hopefully this will change after they learn of the breach, but at the moment, these families include: the Ambassador of Uzbekistan to Singapore (passport DA0006280, daughter's passport DA0006301, home address: 18 Tanglin Walk, Tanglin Hill Condominium). A Goldman Sachs Executive Director (passport Z6208645, son's passport V1146894, home: Block 297, Punggol Central, #14-485). A Vice President of GIC Special Investments -- Singapore's $800 billion sovereign wealth fund (passport F7623934, son's passport H8673949, home: 26 Bayshore Road, The Bayshore, #18-07). A JPMorgan Chase VP in Tokyo earning ¥10,000,000. A Facebook/Meta Director with Singaporean passport K0985142B. A Korean Army officer. An Egyptian diplomat from the Ministry of Foreign Affairs. 218 Standard Chartered Bank families. 239 Tata Consultancy Services families. 113 Accenture families.

These are not credit card numbers that can be easily cancelled. These are government identity documents belonging to children and their families. For many of these nationalities, passport replacement is expensive, slow, and bureaucratically painful. For some, it requires an embassy visit in a country they may not live in. But that's not actually a cause for concern, according to GSG's negotiator:



See? Losing the passport data for every student and every family who ever attended their schools is no big deal; it'll all expire in 5–10 years. That's basically no time at all. Totally unimportant, just like the thousands of emails of parents talking about their children's mental health and behavioural problems and photocopies of the government IDs and passports for everyone who works for them or has applied for a job.


9.4 MILLION INTERNAL MESSAGES (2006–2024)

The complete PG_Campus_Mails database: every message ever sent between parents, teachers, counsellors, coordinators, and administrators across every GSG campus for nearly two decades. 8,584,247 messages on the main table alone. Full HTML bodies, subjects, sender IDs, timestamps. ~42 million routing records mapping every sender-to-recipient relationship.

We ran keyword searches across the full corpus and verified the following:

- 14,236 medical disclosures naming specific children with specific conditions
- 2,115 bullying reports naming assailants and victims
- 4,242 incident reports (physical altercations between named students)
- 1,064 disciplinary actions (theft, misconduct, warning cards)
- 170 harassment complaints including physical and sexual harassment
- 550 accident reports
- 271 warning letters to parents about named children
- 618 salary grievances from teachers revealing individual pay ("my salary is 3200")
- 410 resignation letters with personal circumstances
- 70 suicide references
- 37 self-harm disclosures
- 184 messages explicitly flagged as confidential by senders

We include a sample of these in an appendix below the post on our site -- go ahead and take a look. GSG deemed these "not significant". We do not agree.

Parents send these messages in trust. They write to their child's teacher about a suicide attempt, a panic attack, a bullying incident, an abuse disclosure -- and they believe that communication is confidential. GSG stored it all in one database, behind one password, with no encryption, for eighteen years.

We extracted thousands of extraordinarily sensitive communications throughout the email databases. Below are a few samples. We have redacted students' names, because unlike GSG, we give a damn about children's safety.

A principal in Singapore, writing to a parent: "She shared that she overdosed on Ibuprofen the previous night and was also in possession of her prescription psychiatric medication (23 tablets in an unmarked bottle). She said that she has been experiencing feelings of self harm since a week. While waiting for you to reach school, she impulsively took cough syrup in the sick room as well."

A school counsellor in Singapore: "She insisted that she was feeling suicidal and somebody in her head was telling her to do harmful things. She even listed out examples such as while crossing the road to stand in front of the car. [REDACTED] and her friends had been in contact with me for the past two to three weeks explicitly mentioning her suicidal thoughts."

A parent writing about her daughter's hospitalisation: "I would like to advise you that [REDACTED] has been admitted to the hospital for observation due to her claims of being suicidal."

A teacher in Bangalore: "Today during the lunch break, [REDACTED] removed the blade from her sharpener and tried to self harm. She has got a few scratches on her hand."

A teacher's anecdotal record: "[REDACTED] has been increasingly talking about suicide, depression and is often heard making statements such as 'I want to cut myself,' 'I want to fake my death,' 'I want to jump off from a height to see if people care for me.' The frequency and intensity of these statements is alarming."

A parent from the Singapore campus: "She stated that she has been contemplating self-harm, including cutting her hands and throat. This is an extremely alarming situation."

A parent in Singapore writing about another child in her daughter's class: "She tried to cut her wrist with a fork in the school cafeteria."

A parent from Dubai: "My daughter developed severe depression because of the bullying suffered on the school. From June last year I am informing the school what is happening. [...] The school did nothing. This led my daughter to a state of depression up to the point to hurt herself."

A mother in Tokyo, writing matter-of-factly about her six-year-old daughter: "I believe it is thanks to Ms. Priyanka that even though she is kicked, molested and abused by her classmates, she does not miss school."

There are thousands more. 

These children trusted their school. Their parents trusted their school. GSG stored their most vulnerable moments -- overdoses, self-harm, suicidal ideation, abuse, psychiatric hospitalisations -- in a database accessible to anyone with the password giis123, which was every teacher in the organisation.


TRANSPORT AND PHYSICAL TRACKING

107,603 transport user records with residential addresses, dates of birth, phone numbers. 183,731 daily trip attendance records mapping when children were picked up and dropped off. 1,925 bus stops with GPS coordinates. 1,079 bus routes.

Combined with the 221 million student attendance log entries, which track every day every student was present or absent at every campus, this data reconstructs the daily physical movements of tens of thousands of minors across seven countries.

EMPLOYEE DATA

143,494 salary records with annual CTC values. 25,332 performance appraisal records with manager ratings and comments. 12,602 variable pay records. 156,964 HRMS attendance records including check-in/out times and campus locations. 2,311 reporting line records with named managers. Complete organisational hierarchy. Salary amounts range from SGD 3,200/month for junior teachers to SGD 350,000+ per year for senior leadership.

JOB APPLICANTS

46,901 applicant folders in 03_applicants/. These contain passport photocopies, work permit photocopies. Indian Aadhaar biometric ID cards. 163 contain credit card statements. 153 contain medical certificates.


EVERYTHING ELSE

- 22,996 campus visitor photographs across 14 campuses 
- 616,724 email attachments (254 GB) including report cards, bonafide letters with passport and NRIC numbers, medical certificates with government IDs
- 122,862 Twilio SMS messages to 34,708 unique phone numbers -- GSG's own phone numbers, including branded UAE sender IDs (GIIS DXB, GIISAUH, EASCHOOLSHJ, GIS-DXB, GLOBALSA)
- 112 CodeCommit source code repositories -- complete SmartLearn platform with hardcoded AWS keys

---

THE WORLD'S DUMBEST NEGOTIATORS

We do not normally publish our correspondence with breached companies. We have only done this once before, with youX when they served us with an injunction after we took down our posts. But GSG's conduct was so extraordinary -- so dishonest, so stupid, so contemptuous of the process, which every company but them takes with the utmost seriousness -- that we are making an exception.

We contacted GSG in early May and offered them a fair settlement of $750k. For context, our ask was less than what a single year's tuition costs for a classroom of students at their Singapore campus. It was 0.17% of Apollo's committed capital. It was, by any measure, a fraction of the regulatory and legal exposure GSG now faces.

GSG's response was to lie. Repeatedly. About everything.

LIE #1: "MANY OF OUR BRANCHES ARE FRANCHISEES"

GSG claimed their campuses were independent franchisees, not company-owned. This was false. In July 2023, their own press release announced that Apollo had nearly doubled its commitment to S$440 million, funding "over US$650 million" in investments and "over 25 acquisitions" -- described as "100% acquisition." Dwight School Seoul, Glendale Academy Hyderabad, Silveroaks Bangalore, Regent International Malaysia. Full acquisitions. Not franchise agreements. There are dozens of articles and announcements making this fact very clear.

The franchise model ended years ago. GIIS Chinchwad became Elpro International School when the franchise expired. GIIS Dubai's original partner, Scoreplus Education, split from GSG in 2012. GIIS Surat closed. We laid all of this out. GSG's negotiator responded with obfuscation and dumb bluster, and pivoted to another angle in their attempt to lower the price.

LIE #2: "SHINYHUNTERS IS EXTORTING US"

GSG initially claimed ShinyHunters had taken the same data at an earlier date and were also extorting them. They said ShinyHunters had "showed them the entire database" (as if it were a single database that we had taken), so they "knew they had it", unlike us. We contacted ShinyHunters directly to ask them about this. They said they had never heard of them.



When we relayed this, GSG did not miss a beat; they simply swapped out ShinyHunters for unnamed "other groups" -- conveniently unverifiable.

But sure, okay, we thought. With their abysmal security, it was not impossible for multiple attackers to have gotten overlapping data. Maybe they were just confused about how data, breaches, and data breaches worked. We were ready to chalk it up to ignorance rather than deceit.

But that was before we realized what sort of deranged pathological liars we were dealing with.

LIE #3: "OVER 99% OF THE DATA IS ALREADY ON THE DARK WEB OR HAVE I BEEN PWNED"

You can see this claim in the screenshot above. They repeatedly made this claim, which is bizarre, because all it takes is subscribing to HIBP to see that this is completely and utterly false. Some of the emails are in there, true, because the fact is everyone's email has been in multiple data breaches. But that's it: just emails. Maybe a few addresses, though we couldn't find any. What certainly was not present: a single passport number of their students or parents, a single government ID card of any of their applicants, and of course, not a single sensitive email discussing their students' most personal issues.

LIE #4: THE FABRICATED DARK WEB LISTING

This is where it gets truly insane.

GSG's negotiator sent us a screenshot of a dark web forum post allegedly showing our data being sold by a user called "LedgerWraith" for $250,000. They claimed it was discovered by a monitoring service called "CloudSec."



The listing was fake. Every number in it -- the 4.8 TB, the 35,938 student records, the 33,000 passport numbers, the 9.4 million messages, the 221 million attendance rows, the 143,000 salary records -- was copied directly from our own communications with GSG. Our exact deduped numbers. Even if another actor had gained access to precisely the same services we had, we deduped and quantified it in an idiosyncratic fashion. There is close to zero percent chance that they would have the same counts for a single data source, let alone all of them. The language, also, mimicked the emails we had sent them. The phrase "random file selection supported for scope verification" was lifted from our verification offer.

They also apparently fed the AI several of our leak posts, since some styling appears to be poor, inane, cringeworthy imitations of our own writing on our site. The line "Centralised means one key, everything. The inbox was the front door" bookended by idiotic emojis, in particular, is one of the most cringe things we have ever seen generated by AI. The fact that it was used with a straight face -- to apparently convince us that we had written it ourselves -- absolutely boggles the mind.

Furthermore, as posters here will know who knows the underground market ecosystem will notice that the price is absurd: $250,000 as a "starting bid" for school data on a "dark web forum" -- this is not a price this sort of data would ever go for. Period. Not even 10% that price. Maybe 5%. As a comparison, we recently saw TeamPCP's listing for the entirety of Eli Lilly's source code -- ~1,400 GitHub repositories -- for $70,000. And that's one of the highest listings we have ever seen. $250k is exactly what it looks like, a fictitious number hallucinated by an LLM and used by morons who couldn't be bothered even to lie properly.

The account "LedgerWraith" does not exist on any dark web forum. The monitoring service "CloudSec" does not perform dark web monitoring ; it is a Thai penetration testing firm with no relationship with GSG. GSG does not even operate in Thailand. They fabricated the name, in other words, because it sounded like a cloud security company: CloudSec. Brilliant.

GSG fabricated a dark web listing using an AI chatbot fed with our own correspondence, attributed it to a fictional vendor and sent it to us expecting that 1) we would believe them and 2) the alleged sale would result in a lower price. Their argument: why pay if your own members are out there selling it? Just like their "why pay if ShinyHunters or whoever has it as well?" argument.

This is, without exaggeration, the single dumbest thing we have ever encountered in this line of work. And we encounter a lot of it. This level of senseless self-sabotage, however, is truly next level stupid. The fact that they thought this would be a successful ploy to get us to lower the price makes us wonder how they manage to run a school at all, let alone a chain of them.

These are not the best and the brightest. As if there were not a hundred red flags about the fake listing they sent -- including that there are no such sales posts or users on any underground forum, they could not even get the details right between the two ostensible "screenshots" of the fictitious listing. We're limited on how many images we can attach here, so see the post on our site, but they couldn't even keep the forgery consistent.

THE AFTERMATH

When we confronted GSG about their fabricated "evidence", their response was to say that they knew we would claim it was a fake, and pivot into using the alleged "sale" as a reason not to pay the full price for deletion -- as they had planned all along.

They then offered us $100,000. Again. But at that point, we were so disgusted that no amount of money would have gotten them off the hook. The fake post was a step too far, and in using it and doubling down on the lie, they torpedoed any chance of a settlement and condemned themselves to face the consequences.



The entire chain of events has been difficult for us to believe. A school holding 33,000 children's passport numbers, mental health records documenting suicide attempts and self-harm, and 9.4 million private parent-teacher communications -- a school backed by $440 million in Apollo capital -- was offered the chance to resolve this for a relative pittance and instead chose to fabricate evidence, lie about their corporate structure, invent phantom threat actors, and completely fictionalise the presence of the data on data leak / dark web tracking sites like Have I Been Pwned.

WHAT WE ARE RELEASING TODAY -- A DETAILED MAP OF THE HIGHLIGHTS PACK

We are releasing a curated 111 GB highlights pack. The full 4.8 TB dump will follow soon.

Children's names are redacted throughout. We do this not for GSG's sake, but in spite of them. We take no pleasure in publishing any of this. We are doing so because we believe parents have a right to know what their school allowed to be exposed, and the way it was "protected", if you can even call it that.

We will share the complete unredacted dataset with:

- Verified journalists investigating the breach
- The Singapore PDPC, India's Data Protection Authority, and the UAE data protection office
- Attorneys representing affected families
- Verified researchers

If you would like a copy, send us an email (use your company domain) at [email protected].

The pack contains the following:

01 - Internal Messages (9.6 GB). The complete PG_Campus_Mails database from GSG's dedicated mail server. Every message ever sent between parents, teachers, counsellors, and administrators across every campus since 2006. 8.5 million messages on the main table, with multiple temporal snapshots (December 2024 backup, March 2025 snapshot) enabling forensic comparison. 42 million routing records mapping every sender-to-recipient relationship. 3,489 mail attachment records with S3 URLs. This is where the suicide disclosures, bullying reports, salary grievances, harassment complaints, and confidential-flagged messages live.

02 - Student Databases (687 MB). The core identity databases for every student, parent, and teacher across all GSG campuses. The centrepiece is ICSStuInfo_FULL_35938_STUDENTS.jsonl -- decompressed, one student per line, 197 columns, ready to open in any text editor. 35,938 students, 33,088 passport numbers (student, father, mother). Home addresses with block/unit/postal code. Both parents' employers, positions, and income brackets. Medical conditions, religion, caste, emergency contacts. Also includes 12,303 teacher accounts with passwords stored in plaintext - 12,301 of which are giis123 - decompressed as TEACHER_PASSWORDS_PLAINTEXT_12303.jsonl. Plus the 71,547-record SITUsers.json user directory spanning all campuses and brands.

03 - Applicant Documents (92 GB). The complete gsf-career S3 bucket. 46,901 individual folders, one per job applicant. These are not database records -- these are the actual scanned documents. Photographs of passport bio pages, visa stamps, and government-issued identity cards. 12,476 folders contain passport scans. 6,139 contain visa or work permit copies. 142 contain Aadhaar cards (Indian biometric national ID). 163 contain credit card statements. 153 contain medical certificates. In addition to Indian applicants, citizens of Korea, America, the UK, Japan, and Australia are impacted, to name a few. This is the largest component of the pack by size.

04 - Visitor Photos (2.3 GB). 22,996 photographs of every person who physically entered a GSG campus - parents, visitors, delivery personnel, contractors. Each linked to a visitor record with name, phone, email, government ID, purpose of visit, and blacklist status.

05 - Employee Compensation (77 MB). Complete salary and performance data for every GSG employee across all campuses. 143,494 salary records with individual amounts per salary head. 8,416 Annual CTC records. 25,332 performance appraisals with manager ratings, comments, and targets. 12,602 variable pay records with increment percentages. 957 PMS Excel files and 25 HR letters. Salary amounts range from SGD 3,200/month for junior teachers to SGD 350,000+/year for leadership.

06 - Source Code (2.5 GB). 112 CodeCommit repositories comprising the complete SmartLearn/MyGIIS platform -- backend (C#/.NET), frontend (Angular/React), mobile (Android/iOS), and infrastructure (ArgoCD, IdentityService, GlobalLogin). Hardcoded credentials throughout: AWS access keys in Angular environment files visible to any browser, database connection strings with Encrypt=false, JWT signing keys, AES-256 encryption keys.

07 - Credentials (548 KB). The full AWS Secrets Manager dump. 168 entries covering every microservice across all environments. These are rotated now -- it took them several weeks after we contacted them -- but we want to show the scale of the exposure.

08 - MongoDB (1.1 GB). Dumps from 4 MongoDB servers. 107,603 transport users with home addresses. 183,731 daily trip records with GPS coordinates. 1,925 bus stops, 1,079 routes. 25,362 staff-parent messages. 13,195 chat threads. 268,968 helpdesk accounts. And READ_ME_TO_RECOVER_YOUR_DATA -- the 2022 ransom notes, still sitting there four years later.

09 - Twilio SMS (1.5 GB). Complete production Twilio account dump. 122,862 SMS messages up through April 2026. 34,708 unique phone numbers across 7 countries. 5,211 unique student names linked to parent phones. GSG's 3 owned phone numbers (+14243519626 US, +601130115667 Malaysia, +6582410436 Singapore) and 6 branded UAE sender IDs (GIIS DXB, GIISAUH, EASCHOOLSHJ, GIS-DXB, EASCHOOL, GLOBALSA).

10 - HRMS (1.8 GB). Human Resources Management System data. 156,964 employee attendance records. Leave balances. 2,311 reporting line records with named managers. 2,916 HR files from the gsg-hrms S3 bucket.

11 - User Photos (62 MB). Staff and user profile photographs from the gsg-users S3 bucket.

Finally, we’d like to direct your attention to the CEO and founder of this institution: Mr Atul Temurnikar. This is the man who is directly responsible for this disaster. The man whose mic appears to have been swallowed by his bloated face.




We strongly suspect that he is the individual we were negotiating with, or if not, he was at least directly involved in the negotiations. At one point we sent Mr Temurnikar an email requesting the negotiator be replaced, as his combination of arrogance, immaturity and idiocy was going to lead to a disastrous outcome. 

And what a surprise, that disaster came to pass.

We hope the takeaway from all of this is a clear one: If you cannot afford to protect your students' data, you cannot afford to collect it.

We look forward to watching the tsunami of lawsuits Global Schools will be hit with imminently.