North Queensland Cyber Watch: All Souls St Gabriels School confirms a cyber incident after ransomware claim

This is an update to the earlier North Queensland Cyber Watch entry on All Souls St Gabriels School in Charters Towers, which a criminal ransomware group, The Gentlemen, had listed as a victim on its leak site. When I wrote that entry on 10 October 2026, the only evidence was the listing itself. That has now changed in one important respect: the school has spoken on the record.

According to Cyber Daily’s report of 13 October 2026, a spokesperson for the school said it is investigating “a cyber incident involving an unauthorised party accessing a part of our systems”. That is a confirmed cyber incident. It is not, on the current public record, a confirmed data theft: the school says its investigation into the impact is ongoing, and that external forensic experts are assessing the online claims. All Souls St Gabriels School is not accused of any wrongdoing; it is the target of a crime.

Photo by Vitaly Gariev on Unsplash.

What has been reported

Cyber Daily’s article, by David Hollingworth and published on 13 October 2026, is the first news report I have found on this incident. It reports that The Gentlemen listed the school in an October 9 leak post, that the group has not shared how much data it says it took or what it is demanding, and that the group is threatening to publish within four days.

The same article carries the school’s statement. A spokesperson told Cyber Daily that:

• the school is aware of the claim and is continuing to investigate “a cyber incident involving an unauthorised party accessing a part of our systems”;
• as soon as it became aware of the incident, it “immediately took steps to secure our systems, engage the support of cybersecurity and forensic experts and commence an investigation into the extent of the impact”;
• parents and staff were informed of the incident “late last week”, and stakeholders will be kept updated as the investigation progresses;
• “If any personal information is identified as being involved, we will communicate with impacted individuals directly”;
• the school is “aware of online claims related to the incident and information that is said to belong to our school”, and external forensics experts are assessing those claims and monitoring for further developments;
• the Australian Cyber Security Centre has been notified, and the school will continue to notify government authorities as necessary.

The listing facts have not changed since the earlier entry. ransomware.live’s victim page still records All Souls St Gabriels School (allsouls.qld.edu.au) under The Gentlemen, in the Education sector, with a discovery date of 9 October 2026 and an estimated attack date of 6 October 2026. SOCRadar’s page for the listing still shows its status as “Claimed”, and Breach House still shows the entry’s leak status as “pending”. Both were unchanged when I checked on the morning of 13 October 2026 and again at about 20:05 AEST that evening. Neither tracker status tells us anything about what the group actually holds.

When I checked the school’s homepage and news page at about 10:25 AEST on 13 October 2026, and again at about 20:05 AEST, neither carried a public incident notice. That is not a contradiction of the statement: the school says it told parents and staff directly, and its public comment so far has come through the media. There was also still no matching entry on Webber Insurance’s list of Australian data breaches when I checked that morning.

What is reported, claimed and still unknown

The line between these three categories has moved since the earlier entry, so it is worth redrawing it carefully.

• Reported: The school has confirmed, in a statement to Cyber Daily, a cyber incident in which an unauthorised party accessed part of its systems. It says it has secured its systems, engaged cyber security and forensic experts, told parents and staff, and notified the ACSC. Public trackers including ransomware.live continue to index the leak-site listing.
• Claimed by the group: that it holds data belonging to the school, and (as Cyber Daily reports) that it will publish within four days. Those are the group’s claims. The school has not confirmed that any data was taken, and it has described the information as “said to belong to our school”, which is careful language for a reason.
• Not established publicly: whether any personal information was copied or stolen; what kinds of records, if any, were involved; how many students, families or staff might be affected; how the unauthorised party got in and when; whether systems were encrypted; whether a ransom has been demanded or discussed; whether the group has published anything; and whether the school has notified, or will need to notify, the Office of the Australian Information Commissioner.

The confirmed part is narrower than a headline might suggest. “An unauthorised party accessing a part of our systems” confirms that the incident is real. It does not confirm the group’s account of what it took. Leak-site claims are sometimes inflated, and organisations often need weeks of forensic work before they can say with confidence what was and was not accessed. Until the school says otherwise, both things are true at once: there was an intrusion, and the scale of any data loss is unknown.

How this compares, and who The Gentlemen are

This is the pattern the earlier entry described as the other side of the line. In the Townsville Christian College entry, the College confirmed a ransomware attack in a notice to its community issued under the Notifiable Data Breaches scheme. All Souls St Gabriels is at an earlier stage of the same road: it has confirmed an incident and is still working out its impact, which is exactly when a careful organisation says less rather than more.

The earlier entry covers who The Gentlemen are and how, according to Australian threat-intelligence reporting, its affiliates typically get in. Cyber Daily’s latest article adds that the group is now second only to Qilin by victim count, and that affiliates keep 90 per cent of any ransom paid. Sources differ on exactly when the group emerged: Cyber Daily says September 2025, while ransomware.live’s group page says July to August 2025.

What families, students and staff should do

The school says it has already contacted parents and staff, and that it will contact anyone whose personal information is found to be involved. While the investigation runs:

• Rely on direct communication from the school, not on tracker sites, social media posts or forwarded screenshots. The school is the only party that can tell you whether your information is affected.
• Do not go looking for any published data. If the group does publish something, do not search for it, download it or share it. Leaked files can carry malware, and passing them around spreads the harm to other families.
• Expect scams that use the incident as a hook. An email, text or call that mentions the school’s cyber incident and asks you to “verify” details, pay a fee, or click a link should be treated as a scam until the school confirms it.
• Do not act through links in a message. If something claims to come from the school, phone the school on the number on its website, or open its app or portal yourself.
• Never give a password, card number or one-time code to someone who contacts you. A genuine breach notification will not ask for these.
• If identity documents are later confirmed as involved (a licence, passport or Medicare card), consider a free credit ban with the credit bureaus, and contact IDCARE (1800 595 160), Australia’s free national identity and cyber support service.
• Report suspicious contact to Scamwatch, and keep any notice the school sends you.

The lesson for North Queensland organisations

The earlier entry’s lesson was about the entry points this group is known to use. This update’s lesson is about the response, because the school’s statement shows several things that every regional organisation should have ready before it needs them.

On what has been reported, the school told its own parents and staff directly (“late last week”, by its account) before the first news report I could find appeared, engaged forensic specialists, notified the ACSC, and has been careful to separate what it knows (an unauthorised party accessed part of its systems) from what it does not yet know (whether personal information is involved). That is a sound order of operations. Whether your organisation could do the same in its first 72 hours depends on decisions made long before then.

A useful review covers:

• who you call first: an incident response provider, your cyber insurer and your legal adviser, with contact details held somewhere that does not depend on your own email or file server;
• how you reach your community if your systems are down: an up-to-date family and staff contact list, and a messaging channel that sits outside the affected environment;
• a holding statement: plain words, approved in advance, that confirm an incident without guessing at its scale;
• reporting: who reports to the ACSC through ReportCyber, who contacts police, and who decides whether an incident is notifiable to the OAIC;
• a Notifiable Data Breaches assessment process: the OAIC says organisations covered by the Privacy Act 1988 must notify affected individuals and the OAIC when a data breach involving personal information is likely to result in serious harm, so know who assesses that and how;
• claim monitoring: someone, internal or contracted, who watches the public trackers and media once a listing appears, so you are not learning about your own incident from a journalist;
• a data map: knowing which systems hold student, family, health, boarding and identity records, because “is any personal information involved?” is the first question families will ask and the hardest to answer quickly;
• the basics that make the response easier: tested offline or immutable backups, logging that is kept long enough to reconstruct what happened, and MFA on every remote-access path.

ASD’s Australian Cyber Security Centre publishes the Essential Eight as a baseline for making systems harder to compromise, and the OAIC’s Notifiable Data Breaches guidance sets out when an incident has to be reported. Neither replaces a response plan your leadership has actually rehearsed.

If your organisation wants an independent, practical look at incident readiness, communications planning, remote access, identity and Microsoft 365 hygiene, Suburban Secure works with organisations in Townsville and Cairns. The review is designed as an independent second opinion: the findings belong to the organisation, and the organisation chooses who acts on them.

The accurate headline is still narrow, but it has moved. All Souls St Gabriels School has confirmed a cyber incident in which an unauthorised party accessed part of its systems, and it has told families, engaged forensic experts and notified the ACSC. The Gentlemen claims to hold the school’s data and threatens to publish it. Whether any personal information was taken has not been established publicly, and the school says it will contact affected people directly if it was.

---

References

Hollingworth, D. (2026, October 13). Exclusive: All Souls St Gabriels School investigating cyber incident in wake of ransomware claims. Cyber Daily. https://www.cyberdaily.au/security/14287-exclusive-all-souls-st-gabriels-school-investigating-cyber-incident-in-wake-of-ransomware-claims

All Souls St Gabriels School. (n.d.). Homepage and News pages (no public incident notice). https://www.allsouls.qld.edu.au/ and https://www.allsouls.qld.edu.au/news/ (checked 13 October 2026, about 10:25 and 20:05 AEST).

Ransomware.live. (n.d.). All Souls St Gabriels School (victim page; group Thegentlemen; discovered 2026-10-09 19:24 UTC; est. attack date 2026-10-06; sector Education). https://www.ransomware.live/id/QWxsIFNvdWxzIFN0IEdhYnJpZWxzIFNjaG9vbEB0aGVnZW50bGVtZW4= (checked 13 October 2026).

Ransomware.live. (n.d.). Thegentlemen / Storm-2697 (group page). https://www.ransomware.live/group/thegentlemen (checked 13 October 2026).

SOCRadar. (n.d.). All Souls St Gabriels School ransomware attack by Thegentlemen (ransomware intelligence; status “Claimed”). https://socradar.io/free-tools/ransomware-intelligence/victims/all-souls-st-gabriels-school-thegentlemen-c78afcd6 (checked 13 October 2026).

Breach House. (n.d.). Thegentlemen (group page; All Souls St Gabriels School entry, leak status “pending”). https://www.breach.house/groups/thegentlemen (checked 13 October 2026).

Webber Insurance. (n.d.). The complete list of data breaches in Australia. https://www.webberinsurance.com.au/data-breaches-list (checked 13 October 2026).

Australian Signals Directorate, Australian Cyber Security Centre. (n.d.). Submit a report. https://www.cyber.gov.au/report-and-recover/report

Australian Signals Directorate, Australian Cyber Security Centre. (n.d.). Essential Eight explained. https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight/essential-eight-explained

Office of the Australian Information Commissioner. (n.d.). Notifiable data breaches. https://www.oaic.gov.au/privacy/notifiable-data-breaches

IDCARE. (n.d.). Get support. https://www.idcare.org/