Cases › security breach › LR-2026-0834

Suspected AI-assisted agentic ransomware attack on UK school estate (3AM affiliate)

Also listed as: AI cyberattacks

Confirmed Why: 2 independent outlets · 2 independent reports

Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.

Status: no action reported

Severity major

Reported 3 Nov 2026

Industry Educational Services

No source states: loss or records, developer and model, agent tool, could do, deployer.

Severity major: a live production compromise of a school estate, with about 37 machines encrypted, backups targeted for deletion and endpoint protection removal attempted.

A 3AM ransomware affiliate targeted a UK school estate, reaching nearly 50 machines from an unmanaged host and encrypting around 37 of them. Bitdefender researchers suspected AI-generated commands and an automated agentic loop because repeated commands were slightly modified at each attempt and issued at roughly regular intervals of 40 to 100 seconds. The researchers could not access the attacker's machine, so the language model, its location, and whether a human relayed instructions remain undocumented; only the behaviour, resembling an agentic loop, was observed. The activity spanned September 10 to 19, with initial access undetermined. The actor extracted and decrypted credentials on three Veeam backup servers, copied a Chrome credential database, deployed Mimikatz and LSASS dumping tools, created two backdoor domain administrator accounts, and configured two-way trusts between three Active Directory domains before attempting to disable Sophos and Bitdefender and delete system-state backups.

What happened

No source tells the story step by step yet.

What was done

No source states an action or fix.

Risks

AI used to run a cyber attack
Primary91 incidents
Rising: 25 vs 3.8 a week

AI system attacked or breached
Also20 incidents

Sorted by rule from the case's fields; not yet read from the sources.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Model

Safety training and refusal · Cyber and weapons safeguards · Abuse monitoring and account enforcement · Staged or restricted release · Dangerous-capability testing before release · Outside red-teaming · Content safety classifiers · Safeguards kept on in testing · Reasoning monitoring

Infrastructure / target

Known flaws patched · Multi-factor sign-in and password policy · Network segmentation · Intrusion and endpoint detection · Backups and recovery · Phishing and fraud filters

Evidence

No source states: a step-by-step account, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.

Show every field, with its source and grade

What happened

Earliest source we hold

2026-11-03

D inferred by us from the described behaviour, reason shown

Themes

ransomware, AI assisted cyberattack, agentic AI, credential theft, data exfiltration, education sector, active directory