Regent Christian Online Academy Data Breach

Regent Christian Online Academy (RCOA), a Canada-based online K-12 institution serving students in British Columbia through rcoa[.]ca and rcoa[.]instructure[.]com, was listed on the Booba Project ransomware group’s dark-web leak portal on October 27, 2026. SOCRadar identified the listing through its Dark Web Monitoring capabilities. As a fully remote learning organization, RCOA depends on online platforms such as Microsoft 365 and its Instructure Canvas learning management system, which makes the institution an attractive target for extortion activity, since disruption to these services would directly impact its educational operations. Booba Project has claimed 25 victims over the previous 60-day window, with Education ranking among its primary target sectors alongside Healthcare and Government & Defense. The group’s activity is concentrated in the United States, Canada, and Pakistan, its primary geographies. Recent listings include other Canadian and educational victims such as Soni Medical Centre in Canada, the University of Illinois Chicago in the United States, and Tulare Western High School in the United States. RCOA fits the group’s North American educational targeting pattern directly, matching both the geographic and sectoral focus observed in Booba Project’s recent leak-site activity. The listing remains alleged and has not been independently confirmed as a breach.

SOCRadar’s stealer-log telemetry for the domain rcoa[.]ca returned 10 records, of which 6 were classified as INTERNAL_AUTH_EMPLOYEE (category A) bearing @rcoa[.]ca corporate usernames. The affected systems span the Microsoft 365 identity provider, the Instructure Canvas LMS at rcoa[.]instructure[.]com, email services, and third-party SaaS platforms. Log and insert dates range from June to October 2026, indicating sustained and recent exposure rather than a single historical event. The simultaneous presence of Microsoft 365 identity provider credentials and LMS credentials indicates broad authentication-stack exposure across the platforms the school relies on daily. For a fully remote learning organization, Microsoft 365 and the LMS constitute the operational backbone, and simultaneous credential exposure across both represents a high-risk posture. The sustained June–October 2026 exposure window suggests repeated infections or prolonged credential persistence in underground markets. Harvested credentials of this type could support unauthorized access to corporate accounts and remote learning platforms, potentially serving as an initial access path for follow-on operations; however, this remains a possible scenario, and the telemetry alone does not confirm that such access was exercised or that a breach occurred. Defenders should treat the identity infrastructure as the priority: enforce phishing-resistant MFA on all Microsoft 365 and LMS accounts immediately, audit for anomalous sign-in activity from outside expected geographies, and rotate all rcoa[.]ca credentials. The entire operational footprint of this remote learning organization depends on the identity infrastructure now confirmed compromised. Continued dark web and stealer-log monitoring is advised to track any further exposure related to rcoa[.]ca and rcoa[.]instructure[.]com.