North Queensland Cyber Watch: Qilin claims a Townsville school as a ransomware victim
Calvary Christian College in Mount Louisa has been named on the Qilin ransomware group’s leak site. The listing was recorded by ransomware.live on the evening of 5 November 2026.
At the time of the checks for this article, the college had not published an incident notice on its website. This is a claim by a criminal group. It does not establish that the school was breached or that anyone’s information was taken.
It is another local school appearing in North Queensland Cyber Watch, less than a month after the All Souls St Gabriels listing in Charters Towers. For families reading this, the immediate question will be whether their information is affected. The public record does not yet answer that.
Photo by Far Chinberdiev on Unsplash.
What the listing shows
The ransomware.live entry names Calvary Christian College, gives its domain as calvary.qld.edu.au, and records discovery at 7:14 pm AEST on 5 November. Its estimated attack date is also 5 November, but a date in a tracker does not establish when any intrusion occurred.
The domain identifies the Townsville college at Mount Louisa. There is a separate Calvary Christian College in Logan, with campuses at Carbrook and Springwood. Nothing in this listing refers to that school.
The listing on the evening of 5 November 2026. Screenshot retained for reporting and commentary; the leak site is not linked.
The screenshot shows the college’s name and logo, an Education label and a countdown of a little over eight days to publication. It also displays a zero-photo counter. The material recorded for this article did not identify what information Qilin claimed to hold, how much there was or where it came from.
A countdown creates pressure. It does not tell us whether the group has the records it is threatening to publish.
By later that evening, SOCRadar also carried the listing, with the status Claimed. Two trackers recording the same criminal claim do not independently confirm an incident.
What we still do not know
The original checks for this article covered the college’s homepage and News & Events page at about 7:45 pm and 10:12 pm AEST on 5 November. Neither carried an incident notice. Searches that evening also found no news report or public police or regulator statement.
That leaves the main questions unanswered: whether anyone gained access to the college’s systems, whether information was copied, which records might be involved and who might be affected. An absence of public comment cannot answer those questions. It also tells us nothing about any communication the college may have sent directly to families or staff.
The All Souls case shows how the public picture can change. A listing appeared first, and the school subsequently confirmed it was investigating a cyber incident. That sequence does not establish what happened at Calvary. Each case needs its own evidence.
Why school records matter
A school needs to know who can collect a child, who to call in an emergency and what a teacher needs to know about a student’s health or learning needs. Those records sit alongside enrolment details, family contacts, fee information and staff records.
They are ordinary parts of running a school. They can also be deeply personal.
This is why I keep returning to schools in this series. The consequences of losing control of that information reach well beyond getting computers working again. A family may need to know whether an address, a custody arrangement or a child’s medical information has been exposed.
None of those categories has been established as involved here. They explain why a school incident deserves care, including care with what we say before the facts are available.
Even a public claim can give a scammer a plausible reason to contact a family. A message offering to “secure your school account” or asking you to verify payment details can sound more convincing when it refers to a story you have just read.
For families and staff
Watch for direct communication from the college explaining what it knows and whether you need to act. If a message worries you, contact the school through its usual app, portal or a phone number you have found independently.
A few precautions are useful while the position remains unclear:
- Check unexpected requests about school fees, account access or personal information through a known contact before acting.
- Open the school portal yourself instead of following a link in an unexpected email or text.
- Keep passwords and one-time security codes private, even if the caller knows your name or your child’s school.
- Keep any genuine notice from the college so you can refer back to its advice.
If you are told your identity information is affected, IDCARE can help you work through the next steps. Suspicious contact can also be reported to Scamwatch.
The practical questions for other schools
There is useful information about Qilin’s methods, provided we keep it separate from this unconfirmed claim.
In its June 2026 account of nine Qilin investigations, Australian incident response firm Triskele Labs described access through exposed Remote Desktop Protocol (RDP) or SSL VPN services without multi-factor authentication. It also reported attackers using legitimate remote support tools to maintain access, and incidents discovered when staff arrived to find encrypted systems in the morning.
Those findings give a school leadership team concrete questions to take to its IT staff or provider:
- Remote access: Which staff and suppliers can connect from outside the school, and how is that access protected?
- After-hours response: If an alert arrives at 2 am, who receives it and who can act?
- Recovery: When was the last successful restore of a system the school depends on?
- Communication: If email and the school portal are unavailable, how will staff and families hear from you?
These are useful questions regardless of how the Calvary claim develops. They should produce answers someone can demonstrate: an access review, an agreed response arrangement, a restore record and a working contact plan.
There is another question I would put alongside them: where does the school’s information actually live?
Enrolment platforms, learning systems, email and outside support providers all need to be included in that discussion. Knowing which supplier holds which records, who can export them and when old information is deleted is part of looking after the school community.
The Essential Eight provides a starting point for reviewing technical controls. The OAIC’s Notifiable Data Breaches guidance is a reference for notification obligations. Schools also need people who know their systems and have time to check that the arrangements work.
Through Suburban Secure, I provide independent reviews of these arrangements for organisations in Townsville and Cairns. The findings belong to the organisation, which can choose who carries out the work.
For Calvary’s community, the unanswered question remains whether any information has been affected. For other schools, there is work they can do now: check who can get in, who will notice trouble and how the school will keep looking after its students if a system goes down.
References
The incident timeline above retains the checks recorded for the original article on 5 November 2026. It does not include direct confirmation from the college.
Calvary Christian College. (n.d.). Homepage, News & Events and About Us. https://www.calvary.qld.edu.au/, https://www.calvary.qld.edu.au/news and https://www.calvary.qld.edu.au/about-us (original checks: 5 November 2026, 19:45 AEST; homepage and News & Events rechecked 22:12 AEST).
Calvary Christian College (Logan). (n.d.). Homepage. https://calvarycc.qld.edu.au/
Ransomware.live. (n.d.). Calvary Christian College (victim page; Qilin; discovery recorded as 5 November 2026, 09:14 UTC). https://www.ransomware.live/id/Q2FsdmFyeSBDaHJpc3RpYW4gQ29sbGVnZUBxaWxpbg
SOCRadar. (n.d.). Calvary Christian College ransomware attack by Qilin (listing status: Claimed). https://socradar.io/free-tools/ransomware-intelligence/victims/calvary-christian-college-qilin-0f794665
Grainger, R. (2026, June 17). Qilin on the rise: what Australian organisations need to know. Triskele Labs. https://www.triskelelabs.com/resources/qilin-on-the-rise-what-australian-organisations-need-to-know
Australian Signals Directorate, Australian Cyber Security Centre. (n.d.). Essential Eight explained. https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight/essential-eight-explained
Office of the Australian Information Commissioner. (n.d.). Notifiable Data Breaches scheme. https://www.oaic.gov.au/privacy/notifiable-data-breaches
IDCARE. (n.d.). Identity and cyber support. https://www.idcare.org/
Scamwatch. (n.d.). Report a scam. https://www.scamwatch.gov.au/report-a-scam