Ransomware victim disclosure

Abu Dhabi Indian School - Branch 1, Al Wathba

Claimed by NIGHT SPIRE · listed 18 hours ago

600 GB

Data size

Today

Age

since listed · listed for ransom

Status timeline

Listed
Jun 6, 2026

Current state: Listed for ransom

At a glance

Group: NIGHT SPIRE
Status: Listed for ransom
Country: United Arab Emirates
Sector: Education
Listed on leak site: Jun 6, 2026
Data size: 600 GB

About the victim

AI dossier — public-source company profile

Abu Dhabi Indian School Branch 1 is an educational institution located in Al Wathba, Abu Dhabi, United Arab Emirates, serving the Indian expatriate community in the region.

Industry: Education
Address: Al Wathba, Abu Dhabi, United Arab Emirates

Attack summary

Severity: medium — Exfiltration of 600 GB of institutional data including HR and financial records affecting a school population; however, the leak post shows most data marked 'not available', limiting proof of actual exposure. Educational institutions handle sensitive student and staff data, warranting medium severity.

NIGHT SPIRE claims to have exfiltrated approximately 600 GB of data from the school, including financial documents, HR data, supervisor information, and administrative records. The group lists the victim on their leak site but indicates most data is currently unavailable.

medium

Data the group says was taken

AI dossier — extracted from the leak post

Financial documents
HR data
Supervisor information
Administrative records
Employee records
School operational data

The leak post

captured from the group's site

- Financial Documents- HR Data- Supervisor's Information
Data is not available now.
Data is not available now.
Data is not available now.
[la familia adualt day center](http://www.lafamiliaadultdaycenter.com)
Data is not available now.
Data is not available now.
- QuickBooks Files- Scanned tax returns- Proposal, Contrats- QuickBooks automated backups
- Banking & Financial Records- Personal data- Critical POS Data
- Banking & Financial Data- Accounting & Tax Records
- Financial & Accounting Records- Human Resources- Sales & Marketing
- Sales Related Documents- Human Resources- Sensitive Employee Records- Email and SMS Data
Data is not available now.
- Technical Documents- Financial Sheets- Contracts & Invoices- Business strategy files
- MSSQL-DB- HR Documents- Contracts
Data is not available now.
[Progressive Oral Surgery & Implantology](http://nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onion/progressiveoralsurgery.com)
- Patients Information Records- Financial Records
[The Country Club of Darien](http://nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onion/CCDarien.org)
- Sales / agent / commercial operations- Industrial / manufacturing / tooling business dat…

Screenshot of the leak post

Leak screenshot for Abu Dhabi Indian School - Branch 1, Al Wathba

Sources

Victim sitehttps://www.adiswath
Leak posthttp://nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onion/database

Source

Indexed 18 hours ago

This page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.

Is this your supplier? Your competitor? You?

Pro plans monitor your domain, corporate emails, and crypto wallets across every new ransomware leak-site post, breach dump and Telegram callout — alerts within 5 minutes.

Disclosure context

About NIGHT SPIRE

NIGHT SPIRE is a ransomware group first observed in June 2026 with an apparent primary motivation of financial gain, having claimed at least 14 known victims across multiple continents within a relatively short operational window. Given the group's recent emergence and limited public documentation by major threat intelligence organizations such as CISA, FBI, or Mandiant at this time, a comprehensive technical profile cannot be fully established from open sources. Their targeting pattern, based on available victim data, reflects a geographically diverse focus spanning the United States, Singapore, Brazil, Panama, and Spain, suggesting either an opportunistic targeting approach or a deliberate strategy to operate across jurisdictions that complicate law enforcement coordination. The sectors most frequently impacted include Healthcare, Recruitment and Staffing, Hospitality and Recreation, Commerce and Trade, and Automotive, indicating the group likely targets organizations perceived as having lower cybersecurity maturity or higher operational pressure to restore services quickly, both of which increase ransom payment likelihood. No confirmed affiliations to known ransomware-as-a-service ecosystems, nation-state actors, or predecessor groups have been publicly documented as of this writing. NIGHT SPIRE's operational status as of mid-2026 reflects an active and emerging threat actor, and the breadth of their targeting across critical and commercially sensitive sectors warrants continued monitoring by defenders, particularly those operating in the identified high-risk verticals and geographies. The group has been linked to 14 public disclosures across our corpus. First observed on a leak site on June 6, 2026. The operation is currently active.

Also tracked as: nightspire.

Timeline of this disclosure

June 6, 2026Abu Dhabi Indian School - Branch 1, Al Wathba listed by NIGHT SPIREon the group's public leak site

Data size: 600 GB