Ransomware victim disclosure
← All victimsColegio María Inmaculada (CMI)
Claimed by Bavacai · listed 15 days ago
Status timeline
- Listed
May 5, 2026
- Data leaked
At a glance
About the victim
AI dossier — public-source company profileColegio María Inmaculada (CMI) is a Catholic school located in Moravia, Costa Rica, operating under the domain mariainmaculada.ed.cr. It provides primary and/or secondary education in the San José metropolitan area. The school's public website was not operational at the time of review.
- Industry
- K-12 Catholic Education
- Address
- Moravia, San José, Costa Rica
Attack summary
Severity: high — A school environment holds PII of minors (students), staff records, and potentially financial/family data. The disclosed status is data_published and multiple internal servers including a domain controller are referenced, indicating confirmed network compromise and exfiltration of data that likely includes regulated personal data of children.The Bavacai ransomware group claims to have compromised CMI's internal network infrastructure, identifying multiple servers (CMI-DC01, CMI-APP, CMI-HTTP2, main-server1/2) and the internal domain cmi.local. The post is categorised as data_published, suggesting exfiltration and publication of school data.
Data the group says was taken
AI dossier — extracted from the leak post- Active Directory domain data (cmi.local)
- Domain controller data (CMI-DC01)
- Application server data (CMI-APP)
- Web server data (CMI-HTTP2)
- General server data (main-server1, main-server2)
What the group claims
Catholic school in Moravia, Costa Rica. Domain cmi.local / mariainmaculada.ed.cr. Servers: CMI-DC01, CMI-APP, CMI-HTTP2, main-server1/2.
The leak post
captured from the group's siteFile Manager File Manager home page BARAAAI Data is being prepared for publication. BAPAMAI Data is being prepared for publication. BAUARAI Data is being prepared for publication. BAVADAI Data is being prepared for publication. BAVACAI Data is being prepared for publication. BAVAQAI Data is being prepared for publication. Raycolighting DEMO 3137 S Alameda Street, Los Angeles, CA 90058, USA $10 000 Organization with 2 emails extracted. Domain: raycolighting.com baralai Data is being prepared for publication. CEAGESP / Netfeirasp DEMO São Paulo, Brazil $20 000 Brazilian produce wholesale market network. Domain netfeirasp.ceagesp (CEAGESP). Also demarchibrasil.com.br accounts. Colegio María Inmaculada (CMI) DEMO Moravia, San José, Costa Rica $50000 Catholic school in Moravia, Costa Rica. Domain cmi.local / mariainmaculada.ed.cr. Servers: CMI-DC01, CMI-APP, CMI-HTTP2, main-server1/2. Académie de Montpellier / CSJM DEMO Béziers, Occitanie, France $15000 French public school network. Domain CSJM.BEZIERS, part of Académie de Montpellier (ac-montpellier.fr). Occitanie region (laregion.fr). Teacher and admin staff credentials. Palmers Relocations DEMO Victoria, Australia $63 000 Australian …
Sources
Source
Indexed 15 days agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
