The Incransom ransomware group, also tracked as INC Ransom, says it stole 271GB of data from the American Council on Education (ACE). ACE is the Washington, DC body that coordinates US higher education and represents more than 1,700 colleges and universities. According to the group's leak post, the data includes personal records, financial and federal grant files, executive email, and material tied to ACE's work for the Department of Defense. These are the attacker's claims and have not been independently verified. ACE has not commented publicly, no regulator filing or breach notice has been published, and no established security outlet has reported on the incident. Everything below comes from the group's own disclosure as relayed by the threat-tracking sites QPulse and CTIWatch.
What Happened
CTIWatch reproduces Incransom's leak post, which is headed "Data Breach Disclosure" and dated September 30, 2026. The post claims the group got into ACE's entire network: four Active Directory domains, the Microsoft 365 cloud tenant, 21 SQL Server databases, executive email systems, financial platforms, the CRM, a source code repository, and physical security systems.
The group says ACE leadership "engaged in discussions, then chose to walk away without resolution." It also says that five weeks later ACE had "not notified a single affected individual, institution, or regulator." The post set October 7, 2026 as the date the full dataset would be released.
The dates don't line up across trackers. The leak post is dated September 30 and names an October 7 release date. CTIWatch lists ACE as a victim on November 10, and QPulse published its write-up on November 12. This could mean the listing appeared on the public leak site well after the post was written, or that it was reposted. Neither tracker confirms whether the data was actually published on or after October 7, and nothing seen so far shows the dataset circulating.
CTIWatch lists the victim as "American Council of Education." That is a misspelling of the organisation's name. It is not a different victim.
What Was Taken
All of the following is what Incransom says it holds. None of it has been confirmed by ACE.
- Total volume: 271GB. Both trackers report this figure.
- Personal data: The numbers differ. QPulse reports 426,000 participant records and 1,831 Social Security numbers that it says were stored in plaintext. The table of contents in the leak post, as shown by CTIWatch, labels its personal data section as covering roughly 700,000 individuals. So claims about affected people range from 426,000 to about 700,000, depending on which figure is used and what each one counts.
- Military and defense: QPulse reports facility security clearance documentation and course evaluations related to intelligence work. The leak post says ACE holds a DoD Facility Security Clearance and manages military credit evaluations for the Department of Defense. Military credit evaluation is a long-standing public ACE program.
- Financial and grant records: The leak post's table of contents refers to 18 years of financial records and a federal grants section of about $94 million.
- Executive email: The table of contents lists about 349,000 files.
- Source code, credentials and CRM data: The post names separate sections for source code and credentials, and for "membership intelligence" from the CRM.
If these claims are accurate, the data would affect member colleges, people who took part in ACE programs, service members whose training was evaluated for college credit, and federal partners.
Why It Matters
ACE sits at the centre of US higher education and has formal ties to the Department of Defense. A breach of a coordinating body like this can spread to hundreds of member institutions and to federal programs, even when none of those institutions were breached themselves. Records from military credit evaluation and anything tied to a facility clearance are worth more to attackers than ordinary personal data. They can be used for targeted phishing and impersonation of service members and cleared staff, and to build profiles of people with defense links.
This fits a pattern. SOCRadar reports that Incransom claimed 50 victims in the 60 days before its November 8 listing of the New York PR agency BPCM, mostly in the United States, Brazil and Spain. Professional services, manufacturing and healthcare were the most common targets. Education keeps appearing too: DeXpose recorded an Incransom claim against The New Community School in Richmond, Virginia, on October 7, and against Wavecrest HFA the same day, with that post listing about 24GB across 12,143 files. QPulse also reports a claimed 179GB theft from Onmion LLC, a managed IT provider in Washington state, affecting three of its client organisations.
All of these are still only claims. But the group's habit of posting detailed lists of victims' security failures, and of publicly blaming victims who stop negotiating, is a deliberate pressure tactic, and the ACE post follows it closely.
The Attack Technique
No source says how Incransom first got in. The incident is described as a credential compromise, and the group's claims about what it found point to weak identity controls rather than an exploited software flaw:
- Shared domain admin passwords: QPulse reports that the group says all 11 Domain Admin accounts used the same password. If true, taking over one admin account would have given control of all four Active Directory domains.
- Hardcoded credentials: The group claims it found credentials embedded in code across production, staging and development environments. That would have made it easy to move into databases and cloud services.
- Spreading into the cloud: The claimed access to the Microsoft 365 tenant alongside on-premises Active Directory suggests the compromise crossed from the internal network to the cloud, possibly through synced identities or reused credentials.
Incransom's other recent cases may show how it gets initial access, but they say nothing directly about ACE. At BPCM, SOCRadar found 25 infostealer log records tied to corporate email accounts, with working credentials for HubSpot, Concur and Box, and at least one infected managed workstation. In the Onmion case, QPulse reports that the group says it got in through shared FTP servers, backup systems and the SolarWinds N-Central remote management platform. Stolen credentials and abused remote management tools are both known access routes for this group. Which one, if either, was used against ACE is unknown.
What Organizations Should Do
- Give every privileged account its own password and isolate it. Check that no two Domain Admin accounts share a password. Move to tiered administration with dedicated admin workstations, and use LAPS or a similar tool for local admin accounts.
- Find and remove hardcoded secrets. Scan code repositories and CI/CD pipelines in every environment for embedded credentials. Rotate anything you find and move it into a secrets manager.
- Watch for stolen credentials from infostealers. Monitor for corporate email addresses and SSO accounts showing up in infostealer logs, and reset passwords and revoke sessions as soon as one appears.
- Enforce phishing-resistant MFA on cloud and remote access. Cover Microsoft 365, VPN, remote management tools and any admin portals. Review which identities sync between Active Directory and Entra ID.
- Encrypt sensitive records and keep only what you need. Social Security numbers and other regulated data should never sit in plaintext databases. Delete legacy records that no longer have a business reason to exist.
- Plan for disclosure before an extortion attempt. Prepare notification duties and contracts with partners, including federal and DoD obligations where they apply. A group that names you publicly for staying silent loses that leverage once you have already notified.
ACE members and partner institutions should treat any messages that mention ACE programs, credit evaluations or grant administration with extra suspicion until ACE confirms or rules out the breach.
Sources: Incransom Exfiltrates 271GB from American Council on Education Foll... | Baker Tilly notifies clients of data breach at third-party provider | Incransom Exfiltrates 179GB from Managed IT Provider Onmion LLC, Co... | BPCM Data Breach - SOCRadar | Incransom Targets The New Community School in Latest Ransomware Att... | Incransom Targets Wavecrest HFA in Ransomware Attack - DeXpose | American Council of Education — INC Ransom Ransomware Attack (Nov 2... | American Civil Liberties Union Foundation, Inc. data breach (July 1...