Skip to content
DysruptionHub
Sign in Subscribe

Global Secret Group

Ransomware Group2 claimsLast activity:
Also known as:
  • GSG · Alias

Overview

Global Secret Group, branded GSG on its claim page, is a ransomware and data-extortion claimant tracked by ransomware.live. Its public assertions are threat-actor allegations and do not independently establish responsibility for an incident.

Activity and targeting

Its Seminole Schools listing was first observed by the tracker on Oct. 19, 2026. The listing mixes an Oklahoma school website with a Florida location, while samples in user-supplied captures of the claim page contain indicators of a Georgia school district. That inconsistency limits reliance on the group’s victim labels.

Methods and operational characteristics

The observed page uses a victim profile, claimed data volume, a released-data label, folder index and sample gallery. The available sources do not establish an initial access technique, malware family, encryption method, affiliate model or independently verified stolen-data volume.

What type of group is it?

The public-facing activity supports classification as a ransomware and extortion operation. The reviewed sources do not establish its membership, location, state affiliation or organizational continuity with similarly named actors. A claim and displayed material do not by themselves prove that the group caused a victim’s operational disruption.

Incident claims

Seminole County School System technology disruption

View public claim
Incident date: Source: ransomware.liveDiscovered:

Claim details

Global Secret Group claims Seminole Schools and 39.6 GB across 54,468 files and 5,495 folders. Metadata mixes Florida, sps.k12.ok.us and internal.seminole.org. User reports the linked onion page displays a Georgia audit agreement; supplied screenshot bears names appearing to be Mark Earnest and Sherry Gray, independently corroborated as Georgia district officials. User also supplied full claim-page screenshot showing GSG branding, identical conflicting metadata, RELEASED status, folder index and gallery containing the supplied samples. Credential sample shows the Georgia district’s domain. Georgia victim match assessed high confidence; actor responsibility low confidence; ransomware mechanics, theft volume and personal-data categories unconfirmed. Discovery timestamp is not a verified original publication timestamp.

Columbia University cyberattack and data theft

View public claim
Incident date: Source: ransomware.liveDiscovered:

Claim details

A ransomware.live listing first observed Aug. 14, 2026 names Columbia University Information (Dental) and columbia.edu under Global Secret Group. It alleges 296 GB in 283,387 files and 11,268 folders. These are unverified claimant assertions, not confirmed theft or an affected-person count. No reviewed university statement or forensic evidence connects this later dental-specific listing to the May–June 2025 intrusion and campus outage, establishes a separate successful intrusion, or confirms clinical impact. The listing may concern a separate event, recycled data or misattribution. Its discovery date is not an attack date or original publication date. Columbia’s established 2025 findings and lack of a confirmed responsible actor remain unchanged. Supporting claim evidence confidence is low.

Impacted organizations

Impacted locations

Sources

Created Last updated