Authorities investigating cyberattack on Singapore-based Global Schools Foundation

According to cybersecurity firm Moxfive, FulcrumSec emerged in September 2025. Ransomware tracking sites have attributed more than 20 victims to the group, including Australian fintech firm youX, legal information provider LexisNexis, engineering consultancy Arup Group and environmental services company Interzero. 

The group claimed this week that it had hacked pharmaceutical giant Novo Nordisk and said it was exploring selling parts of the data after unsuccessfully demanding US$25 million from the Ozempic maker.

In a statement to CNA on Jun 17, a spokesperson for Global Schools Group said it had recently experienced a cybersecurity incident and was assessing its impact.

The spokesperson said the cyberattack had been “promptly addressed” with the support of external specialists, that the affected systems had been restored, and that relevant regulatory and law enforcement authorities had been notified.

The group added it had “contained” the incident but did not address FulcrumSec’s specific claims about the scope of the data breach or the types of data accessed.

“We take all such incidents seriously and the security and privacy of our students, parents, staff, and stakeholders remain our highest priority,” the group said.

According to its website, the Global Schools Group operates 12 school brands across 64 campuses worldwide, including in South Korea, the UK and the Philippines. Among them is Global Indian International School in Punggol, Singapore, which has more than 4,000 enrolled students.