Summary
- Belgian school group Bernardusscholen has confirmed a cyberattack involving a backup server.
- Data relating to around 3,550 pupils and 650 teachers was stolen.
- The server was disconnected after the intrusion was discovered.
After attackers compromised a backup server belonging to Bernardusscholen in Oudenaarde, the Belgian school group has confirmed the theft of personal information relating to around 3,550 pupils and 650 teachers.
The affected server was disconnected after the intrusion was discovered, while the organisation confirmed that the attackers had obtained access to personal data belonging to pupils and members of staff.
Public reporting puts the combined affected population at approximately 4,200 people, making the incident substantially larger than a disruption confined to one school or small administrative system within the group.
Although the organisation has confirmed that information was stolen, no attacker has been identified publicly and the available evidence does not establish whether ransomware, extortion, or another motive was involved.
Backup systems can concentrate historical information
Because backup infrastructure commonly contains copies drawn from several operational systems, compromise can expose information that is no longer present in the same form within a live application or that spans a longer period than current records.
The eventual scope of the Bernardusscholen breach therefore depends on what was stored on the affected server, how much historical information the backups retained, and which files the attackers actually obtained rather than simply the number of machines involved.
Education environments can also combine information about minors with staff, parent, academic, welfare, and administrative records, which makes the contents of a central backup particularly relevant when investigators assess the effect of an intrusion.
Bernardusscholen operates several schools across Oudenaarde and describes an organisation educating thousands of young people, while its public profile lists a workforce of several hundred people. The reported figures consequently cover a substantial share of its community rather than a small subset of users.
With the organisation having confirmed theft rather than merely loss of availability, the remaining investigation must establish the precise records involved and whether the attackers reached any systems beyond the compromised backup server.
