Unverified entries are claims made by criminal groups. We list them so analysts can track them, and they may be false.
Tactics: Persistence, Privilege Escalation, Defense Evasion, Discovery, Exfiltration, Impact
Entries are listed newest first by the date on each row: the confirming source's date for verified entries, and for unverified entries the news report's date or the date CyberStack first listed them (recorded from 2 Nov 2026). Entries with none of these are under 'Earlier listings (date not recorded)' in alphabetical order. No tracker dates are shown or used.
Leak sites are not linked.

stjames.wa.edu.au
AUReported: 2026-09-14
Verified: confirmed by the company
Claimed by ThreeAM; the organisation has not named a group
Source: St James' Anglican School incident update (14 Sep 2026)
The notice's 'Monday 14 September' pins the year: 14 Sep 2026 is a Monday and 14 Sep 2025 was a Sunday.
CyberStack report
Company site: stjames.wa.edu.au
Earlier listings (date not recorded)

abcor.com.au
AUUnverified: claimed by ThreeAM, not confirmed by the company
Tracker entry (ransomware.live, third-party; may show leak-site screenshots)
Company site: abcor.com.au

amc.org.au
AUUnverified: claimed by ThreeAM, not confirmed by the company
Tracker entry (ransomware.live, third-party; may show leak-site screenshots)
Company site: amc.org.au

anuenterprise.com.au
AUUnverified: claimed by ThreeAM, not confirmed by the company
Tracker entry (ransomware.live, third-party; may show leak-site screenshots)
Company site: anuenterprise.com.au
M
mctas.org.au
AUUnverified: claimed by ThreeAM, not confirmed by the company
Tracker entry (ransomware.live, third-party; may show leak-site screenshots)
Company site: mctas.org.au

mpspromotions.com
AUUnverified: claimed by ThreeAM, not confirmed by the company
Tracker entry (ransomware.live, third-party; may show leak-site screenshots)
Company site: mpspromotions.com