Signals · Hot · first seen November 3, 2026
Ransomware crew hit a UK school group in September, with signs an AI tool helped retry its commands
Bitdefender said on Nov. 3 that an affiliate of the 3AM ransomware gang broke into a group of UK schools in September and encrypted about 37 of 47 machines across separate networks. Failed commands were retried every 40 to 101 seconds, which Bitdefender reads as a possible AI model suggesting fixes, though it could not confirm it. The attacker stole backup passwords, routed files through a computer the schools did not manage and tried to switch off their antivirus.
Why it matters to a business like yours
The break-in used familiar weak spots, and one computer nobody looks after, like an old front-desk PC or a spare laptop, can be the way in. Ask your IT partner for a list of every machine on your network, and confirm each one runs security software and that your backups have their own separate login.
Sources
- 3AM Hits European Schools: A Hybrid AI Ransomware Attack, Part Human, Part Agentic Loop (Bitdefender, November 3, 2026)
- 3AM Ransomware Hits 37 UK School Systems in Suspected AI-Assisted Attack (Hackread, November 3, 2026)
History
- November 4, 2026: Hot