Baicizhan Hit by DragonForce Ransomware: Data-Leak Risk Expands for 200M-User Education Platform

DragonForce listed Chinese English-learning platform Baicizhan on its leak site on 3 Aug and published data. Cumulative users exceed 200M. Attackers claim user accounts, learning records, and PII. Education and training supply-chain security is under renewed pressure.

On 3 August 2026, the DragonForce ransomware group listed Chinese English-learning platform Baicizhan (Baicizhan; operator Chengdu Chaoyouai Technology Co., Ltd.) on its onion leak site and published a subset of company data. Founded in 2011, Baicizhan provides IELTS, general English, and math tutoring. Cumulative users exceed 200 million. This is the first disclosed DragonForce victim in the 2026 Chinese edtech sector, a marked shift from the group's prior EU/US enterprise targeting, and indicates ransomware operators are expanding onto Chinese SaaS and education platforms.

Incident Overview

DragonForce's 3 August leak page did not disclose compromise timeline, initial vector, or encryption scope. It claimed theft of three sensitive field classes: user account data, learning records, and personal information. Baicizhan's website and primary entry points issued no official notice during disclosure. Third-party threat intel Darkfield added the incident to its tracking database on 8 August, rated medium severity — data published — noting that Baicizhan's user base (200M+) implies a large potential PII exposure.

Technical Details

Since first appearing in December 2023, DragonForce has appeared in 654 disclosures over 13 months and is among the fastest-growing RaaS platforms in Q2 2026. Typical kill chain:

• Initial access: typically weak credentials on internet-exposed VPN / firewall / RDP, or SSO credentials from a compromised legitimate third-party vendor.
• Privilege consolidation: Mimikatz, LaZagne for memory and local credentials; BloodHound / SharpHound to enumerate AD relationships and locate high-privilege accounts, backups, and domain controllers.
• Lateral movement and exfiltration: RDP, SMB, WMI, and PsExec for host-to-host spread; core production databases and object-storage buckets compressed and synced to attacker-controlled Mega / cloud object buckets, then encrypted and archived.
• Double extortion: file-level encryption on victim servers, `README.txt` pointing to the onion site, second data dump after a 7–14 day countdown.

The Baicizhan attack follows the typical DragonForce double-extortion path. User identities, PII, and learning trajectories exported from Discord and Telegram support can fuel credential stuffing against downstream banks, education-installment platforms, and telecom accounts. Downstream risk is significantly higher than a typical SaaS unauthorized-access incident.

Impact Assessment

Baicizhan users include large numbers of minors and parents; secondary PII leakage is highly sensitive. Concurrent leak of accounts (phone, email, password hash + salt), learning records (high-frequency access windows, weak knowledge points, grade positioning), and personal information (nickname, avatar, geolocation) enables education-email stuffing, parent-identity financial fraud, and credential stuffing against Baidu Netdisk and Apple ID. DragonForce has not published a ransom demand or data samples, but the incident is already in data_leaked state: even if the company later pays, the loss is already realized.

Remediation

• Account: If you are a Baicizhan user, change passwords on Baicizhan and any other service using the same password. Enable TOTP beyond SMS. Enable carrier second-factor (MO SMS, number-bound login alerts).
• Enterprise (peer education platforms): MFA and least privilege on internet-facing VPN / firewall / RDP. Isolate MongoDB, object-storage buckets, and ETL pipelines from the public internet. Enable eBPF-based lateral-movement detection. Enforce credential-manager rotation and geo-anomalous login alerts.
• Data: On core databases holding user PII and learning trajectories, enable transparent encryption (TDE) + column-level encryption + client-side field encryption (CSFE). Use immutable backups against DragonForce-style encrypt-and-steal.
• Compliance and disclosure: Under the Personal Information Protection Law and Data Security Law, assess reporting duties for important data / large-scale personal-information leaks: report to provincial-or-higher cyberspace administration and MPS within 72 hours, and notify affected users.
• Threat intel: Subscribe to Ransomlook, DarkOwl Vision, and DragonForce onion monitoring to detect listing of self or critical vendors.

References

• Darkfield Threat Intelligence Baicizhan
• DragonForce leak site (onion) victim page
• Baicizhan official site (user-side reference)
• RansomLook DragonForce ransomware monitoring