Spirit Cultural Exchange Data Breach

Kazu ransomware has listed Spirit Cultural Exchange on its leak site, as identified by SOCRadar’s Dark Web Monitoring service on September 5, 2026. Spirit Cultural Exchange is a US-based organization operating within the educational services sector, specifically focusing on cultural exchange programs. This listing marks kazu’s first publicly claimed victim in the US education sector within the past 60 days, indicating a potential shift in the group’s targeting patterns. The nature of cultural exchange programs involves the handling of extensive personal data for international student participants, including passport and visa details, emergency contacts, and program-specific records. This broad scope of sensitive information presents a significant risk, potentially leading to a wider impact than typical domestic educational organizations might face. Over the last 60 days, kazu has claimed a total of 10 victims, with a notable concentration in the United States, Mexico, and Brazil. The ransomware group has predominantly targeted the healthcare and digital health sectors in its previous campaigns. Notable past victims include PawlyClinic (Digital Veterinary Care Platform), PappyJoe (Healthcare Management System), ConsultorioMovil (Telemedicine and Healthcare System), and Meducar (Telemedicine and Patient Management System). Spirit Cultural Exchange’s inclusion represents a deviation from kazu’s established targeting profile, both in terms of industry and the type of data potentially exposed.

SOCRadar’s stealer-log query for the domain spiritexchange[.]com yielded no results. It is important to note that this query is based on a bounded dataset, and credentials may still exist under alternative corporate domains or personal email aliases not covered by the search parameters. The absence of positive signals in this specific query does not constitute a confirmation that the organization’s environment is entirely unaffected by potential compromises. For the kazu ransomware group, infostealer-harvested credentials are a standard entry vector. These compromised logins are typically validated and then leveraged against corporate platforms such as Microsoft 365 or VPN portals before ransomware deployment is initiated.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.