All ransomware incidents
Ransomware group thegentlemen hits Wellington College International School Bangkok
Wellington College International School Bangkok — a education target operating in TH has been listed by the thegentlemen ransomware group on 2026-10-16. The information below reflects what the threat actor has publicly claimed on their leak site; the details have not been independently verified.
Incident Report
| Target Organization | Wellington College International School Bangkok |
|---|---|
| Threat Group | thegentlemen |
| Summary | Wellington College International School Bangkok, a education organization in Thailand, was listed by the thegentlemen ransomware group on its leak site on 2026-10-17. |
| Date of Breach | 2026-10-16 |
| Discovery Date | 2026-10-17 |
| Region | TH |
| Target Domain | wellingtoncollege.ac.th |
| Business Sector | Education |
| Severity | MEDIUM |
Claim by thegentlemen
wellingtoncollege.ac.th Wellington College Bangkok is a British international school for ages 2 to 18, opened in 2018 as part of Wellington College UK, with around 1100 students on a 28 acre campus in eastern Bangkok. The curriculum runs from the English National Curriculum to IGCSE and A Levels, with the first graduating class in 2026. Fees range from about 639000 baht per year in pre nursery up to 1283500 baht in Year 12, plus a 225000 baht registration fee and a 175000 baht refundable deposit. Results are elite level with 80 percent A star or A at IGCSE and every graduate of 2026 admitted to their first choice university including Stanford, Yale and Imperial College. Admissions are selective with CAT4 testing and interviews, and strong English is required from Year 10. The school is famous for its Olympic pool, FIFA standard pitch, 600 seat theatre, wellbeing curriculum and scholarships in music, swimming, golf and academics.
Posted by the thegentlemen threat actor on its public leak site. This is the group's own statement and has not been independently verified by HackerFeeds.
Disclaimer
HackerFeeds does not engage in the exfiltration, downloading, taking, hosting, viewing, reposting, or disclosure of any stolen information. All breach data reported here is sourced from publicly available threat intelligence feeds for awareness purposes only.