The ransomware group The Gentlemen has named North Macedonia's National Agency for European Educational Programmes and Mobility as a victim on its leak site. The agency is the government body in Skopje that runs Erasmus+ and related EU programmes for the country. The listing appeared on 12 November 2026, according to the threat intelligence site QPulse, which estimates the attack took place a day earlier. The agency has not commented. No regulator filing, national CERT advisory or confirmation from the agency has been published, so the claim is unverified. QPulse, citing infostealer data from Hudson Rock, reports that credentials linked to the agency had already leaked: one employee, two third-party users, 59 passwords and 23 browser cookies.
What Happened
QPulse describes the agency as a government institution set up in 2006 to manage EU education and mobility funding in North Macedonia. That includes Erasmus+, Erasmus Mundus and the European Solidarity Corps. QPulse says the agency manages more than €200 million in EU grants and works with over 1,000 partner organisations. The agency has not confirmed these figures in any public statement we could find.
The incident timeline rests on one source. The leak-site listing is dated 12 November, and QPulse estimates a compromise date of 11 November. No one has publicly confirmed encryption, service disruption, data theft or a ransom demand. Ransomware leak-site listings are often made to put pressure on a victim during negotiations. Sometimes they overstate what was taken. In some cases nothing is ever published.
What Was Taken
Nothing has been confirmed. The Gentlemen have not published a data sample that has been independently checked, and no stolen file types or volumes have been described.
What QPulse does report, citing Hudson Rock, is a set of exposed credentials connected to the agency's environment:
- 1 compromised employee and 2 compromised third-party users
- 59 exposed passwords, 16 of them rated critical
- 23 exposed browser cookies, 1 of them rated critical
QPulse also notes that the agency uses Microsoft 365. An agency like this would normally hold grant applications, beneficiary and participant records, partner organisation details and financial paperwork for EU-funded projects. If the ransomware claim is real, that is the kind of data likely to be at risk. This is an inference from the agency's role. It has not been reported as stolen.
Why It Matters
An Erasmus+ national agency sits between EU funding and thousands of schools, universities, youth groups and individual participants. A breach there could reach well beyond one government office. Partner contact lists and grant records are ideal material for convincing phishing and invoice fraud aimed at the agency's partners and the people who receive its funding.
The claim also comes during a busy period of attacks on European education. In the past six weeks:
- University of Copenhagen: The university says attackers reached a test environment holding data on about 525,000 people, including national identity numbers. It later revealed that card PIN codes for about 20,000 staff and students had been compromised.
- Technical University of Denmark (DTU): DTU says an attacker used compromised credentials to log into its identity system, potentially exposing up to 200,000 current and former users, as BleepingComputer reported.
- Technical University of Munich (TUM): The Register reports that attackers stole portal passwords for every registered myTUM user. They then used a sysadmin's credentials to attack the TUMonline campus system. TUM said accounts protected by multi-factor authentication (MFA) were not affected.
- University of Tübingen: About 3,900 employee records were stolen through a combination of vendor-recommended settings that exposed internal functions, according to heise.
- Canton of Vaud, Switzerland: swissinfo reports that data on about 3,500 teachers and 38,000 students was copied from an IT support platform.
- École 42: A user account with legitimate access was used to scrape up to 140,000 profiles, Cyberiack reports, citing French outlets.
Most of these cases have the same root cause: valid credentials that were stolen, reused or misused, rather than a new exploit. If the infostealer data cited by QPulse is accurate, the Skopje agency fits that pattern.
The Attack Technique
The Gentlemen have not said how they got in, and neither has the agency. QPulse says the compromise was "facilitated by infostealer activity" and names the "Cavalier" stealer family, citing Hudson Rock. Readers should be careful with this attribution. Cavalier is also the name of Hudson Rock's own infostealer intelligence platform, so the label may refer to where the data came from rather than to a specific malware strain.
Infostealer logs also do not show when credentials were stolen or whether an attacker used them. Leaked credentials are a plausible way in, and they match the DTU and TUM cases. The link between these leaked credentials and this specific attack is still unproven. Stolen session cookies matter because they can let an attacker skip MFA prompts on cloud services such as Microsoft 365.
What Organizations Should Do
- Check your exposure. Search infostealer intelligence feeds for your domains, including third-party contractors. Then reset any exposed passwords and revoke sessions, not just reset passwords.
- Revoke and shorten session lifetimes. In Microsoft 365, revoke refresh tokens for affected users. Enable token protection or continuous access evaluation where your licensing allows it, so a stolen cookie stops working quickly.
- Require phishing-resistant MFA everywhere. This matters most for administrators and external partners. TUM's case shows how much one unprotected admin account can open up.
- Lock down unmanaged devices. Infostealers mostly infect personal or poorly managed machines. Use conditional access to block or restrict sign-ins from devices that are not compliant.
- Warn your partners now. Grant-making bodies should tell beneficiaries and partner organisations to expect phishing and fake bank-detail change requests. Payment changes should be confirmed by a phone call or a separate channel.
- Prepare for a data leak. If you are named on a leak site, preserve logs, check outbound data transfers and contact your national CERT and data protection authority early. Do not wait for the group to publish.
Sources: Thegentlemen Ransomware Group Targets National Agency for European... | University of Copenhagen data breach exposes data of 525,000 people | Portal breach at Germany's top university exposes every registered... | Danish university DTU breach exposes data of up to 200,000 people | IT incident at University of Tübingen: Thousands of records stolen... | Data of 40,000 Swiss students and teachers stolen - SWI swissinfo.ch | UPDATED: University of Copenhagen hit by cyber attack – University... | École 42 confirms data breach that may affect up to 140,000 people