{"schema_version":"0.10.0","id":"LR-2026-0561","record_version":1,"title":"Schools blackmailed with explicit AI deepfakes of students","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":52.2,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":3.52,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: securitymagazine.com · subject to change","original_document":null,"reports_total":2,"reports_independent":1,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"1 report: securitymagazine.com · subject to change"}]},"sources_hash":"feefd2a17ff6744c310e56d011d6dcd251bb06c799925aff26bc3a0296cdf07f"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-05-14","incident_class":"harmful_output","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Cybercriminals took ordinary photos of students from school websites and social media, used AI deepfake tools to create sexually explicit images, and sent them to a UK school with a demand for payment to keep the images offline. Late last year, one unnamed UK secondary school received the demand. The Internet Watch Foundation classified 150 of the images as child sexual abuse material under UK law and generated digital fingerprints so platforms could block reuploads. The IWF does not believe the case was isolated, and the Early Warning Working Group says more schools are likely to face similar demands. Advisers now urge schools to reconsider publishing identifiable student photos and to remove full names from captions.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":"third_party","adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK15"},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Test: data of others touched with a bounded scope stated; 150 images from one school","harm_class":[],"affected_description":"one unnamed UK secondary school","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.malwarebytes.com/blog/family-and-parenting/2026/05/deepfake-sextortion-forces-schools-to-remove-student-photos-from-websites","publisher":"Malwarebytes","date":"2026-05-14","type":"press","title":"Deepfake sextortion forces schools to remove student photos from websites - Malwarebytes","archived_url":null,"attachment":"first_report"},{"url":"https://www.securitymagazine.com/articles/102316-schools-blackmailed-with-explicit-ai-deepfakes-of-students","publisher":"Security Magazine","date":"2026-05-21","type":"press","title":"Schools Blackmailed with Explicit AI Deepfakes of Students - Security Magazine","archived_url":null,"independence":"independent"}],"per_field_confidence":{"event.responsible_party":"C","event.adversarial_actor":"C","impact.affected_description":"C","context.country":"C","event.incident_class":"D","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"event.responsible_party":[{"source_index":0,"quote":"blackmailers have been scraping ordinary school photos, feeding them through AI deepfake tools to manufacture child sexual abuse material (CSAM), and demanding payment to keep the images offline."}],"event.adversarial_actor":[{"source_index":0,"quote":"Late last year, cybercriminals contacted an unnamed UK secondary school with that demand."}],"impact.affected_description":[{"source_index":0,"quote":"Late last year, cybercriminals contacted an unnamed UK secondary school with that demand."}],"context.country":[{"source_index":1,"quote":"According to the Internet Watch Foundation (IWF), a school in the United Kingdom was recently targeted with a blackmail attempt after images were taken from its website and/or social media."}],"event.incident_class":[{"source_index":0,"quote":"blackmailers have been scraping ordinary school photos, feeding them through AI deepfake tools to manufacture child sexual abuse material (CSAM), and demanding payment to keep the images offline."}],"impact.severity":[{"source_index":1,"quote":"In all, 150 of the images from this blackmail attempt could be categorized as CSAM under law in the UK."}],"impact.severity_because":[{"source_index":1,"quote":"In all, 150 of the images from this blackmail attempt could be categorized as CSAM under law in the UK."}],"event.summary":[{"source_index":1,"quote":"Images on school websites and social media accounts are being leveraged by cybercriminals to create sexually explicit deepfakes of students, which are then used to extort the schools in paying money to prevent the deepfake images from being released."},{"source_index":0,"quote":"Late last year, cybercriminals contacted an unnamed UK secondary school with that demand."},{"source_index":0,"quote":"The IWF classified 150 of the resulting images as CSAM under UK law and generated digital fingerprints for each image so major platforms could block reuploads."},{"source_index":0,"quote":"The IWF isn’t naming the school or the police force, and it doesn’t believe this was an isolated case."},{"source_index":0,"quote":"The EWWG says it’s “only a matter of time” before more schools face similar demands."},{"source_index":0,"quote":"The EWWG’s advice is to replace close-up, identifiable photos with images taken from a distance, blurred images, or photos shot from behind."}]},"notes_on_gaps":"No autonomous AI agent, AI model, developer, harness or deepfake tool is named or described in the sources, so all system fields are left out. Exact date of occurrence, disclosure and detection are not stated; only 'late last year' is given. The school is unnamed and no count of affected parties beyond the school is stated. Judgements made: agent_involved set to false because no agent is described; trigger set to human_misuse and responsible_party to third_party from the described criminal conduct; detection_method set to third_party because the IWF classified the images; severity set to moderate because one school and 150 images are a bounded scope stated, although the IWF says the case is not isolated; H1 marked missing as an inference from advice to reconsider publishing photos. No control is stated as held or failed in this incident. Publication dates of the articles (2026-05-14 and 2026-05-21) are not incident dates. Other incidents mentioned (GenNomis, FBI IC3 figures, Childline statistics) are excluded. Reversibility and root cause are not stated. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (1 report: securitymagazine.com · subject to change)]"},"context":{"industry":null,"org_size_band":null,"country":"GB","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"caught","text":"The Internet Watch Foundation classified 150 images as CSAM and made fingerprints so platforms could block reuploads.","quote":"The IWF classified 150 of the resulting images as CSAM under UK law and generated digital fingerprints for each image so major platforms could block reuploads.","source_index":0,"grade":"C"},{"step":"done","text":"The IWF distributed hashes of the material to technology platforms to prevent it being uploaded.","quote":"The IWF deployed a digital tool to turn the blackmail material into a “hash” (digital fingerprint) and distributed it to technology platforms to prevent the materials from being uploaded.","source_index":1,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.malwarebytes.com/blog/family-and-parenting/2026/05/deepfake-sextortion-forces-schools-to-remove-student-photos-from-websites","https://www.securitymagazine.com/articles/102316-schools-blackmailed-with-explicit-ai-deepfakes-of-students"]},"analysis":{"sections":{"timeline":[{"text":"The IWF classified 150 resulting images as CSAM and generated digital fingerprints.","quote":"The IWF classified 150 of the resulting images as CSAM under UK law and generated digital fingerprints for each image so major platforms could block reuploads.","source_index":0,"when":null},{"text":"The IWF distributed hashes to technology platforms to block reuploads.","quote":"The IWF deployed a digital tool to turn the blackmail material into a “hash” (digital fingerprint) and distributed it to technology platforms to prevent the materials from being uploaded.","source_index":1,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.malwarebytes.com/blog/family-and-parenting/2026/05/deepfake-sextortion-forces-schools-to-remove-student-photos-from-websites","https://www.securitymagazine.com/articles/102316-schools-blackmailed-with-explicit-ai-deepfakes-of-students"]}}