DreamUp Space Education Company Breach (2026): 1.7 Million Records Including Home Address Exposed via LAPSUS$ Extortion Group

About DreamUp

DreamUp is a U.S.-based space science education and outreach company that operates programs connecting K-12 schools, universities, and individual student researchers with space-based research opportunities including suborbital and low-Earth-orbit experiment platforms. The company partners with operators of commercial-space and government-space research platforms to enable student-designed experiments to be conducted in microgravity environments aboard the International Space Station and on suborbital flights. As an education-focused operator coordinating multi-institutional student research, DreamUp maintains substantial contact-record data including student, teacher, parent, school, and partner-institution information for enrollment management, experiment logistics, parental consent, and event coordination.

Why They Hold Your Data

Education platforms collect student identity, contact details, enrollment records, course participation, and account activity tied to institutional or online learning workflows.

Recent Developments

DreamUp was listed by the 'new LAPSUS$' extortion group on March 1, 2026 on the group's dark-web data leak site. Security researchers and breach-tracking publications including SpyCloud have noted that the 2026 LAPSUS$ group operating these breach claims appears to have no apparent connection to the original LAPSUS$ gang led by Arion Kurtaj (which targeted Microsoft, Nvidia, Samsung, Okta, and others in 2021 to 2022) beyond shared values and branding choices. The new group is associated with the breached.st BreachForums successor site and has begun posting large breaches from major companies including a major pharmaceutical company and an AI-based talent recruiting tool. DreamUp has not publicly detailed the original incident or the specific vulnerability that enabled the compromise. DataBreach.com indexed and parsed the leaked files in mid-March 2026.

Data Points Exposed

Breach Impact

The institutional impact on DreamUp depends on the eventual scope and authenticity of the leaked data, which has not been independently verified beyond DataBreach.com's parsing of the files posted by the threat actor. The threat actor's leak-site framing of DreamUp as a 'ransomware-style' victim has not been corroborated with technical indicators of encryption or operational disruption, suggesting the incident may be primarily data exfiltration rather than encryption-based ransomware. As an educational program operator working with U.S. K-12 schools and universities, DreamUp faces FERPA implications if student data was exposed and potential parental-consent disclosure obligations. The reputational impact concentrates within the space-education and STEM-outreach sector, where DreamUp has been a leading commercial-space education partner.

Exploitation & Downstream Threats

• SIM swap attacks where phone numbers are present | • Targeted phishing campaigns using exposed email addresses | • Doxxing risk from physical address exposure

What You Should Do

1. Treat the home address as exposed: review mail and package handling and physical-security routines, and brief household staff to verify unusual requests.
2. Guard against SIM-swap and vishing: add a carrier port-out PIN and verify any 'support' calls independently.
3. Do not use unofficial 'am I affected' lookups; several are themselves harvesting operations.

How ObscureIQ Can Help

1. Corpus confirmation: determine whether and where the principal (plus household and staff) appear in this dataset and which specific fields are exposed for them.
2. Exposure mapping and footprint neutralization: cross-reference against broker-available data and suppress still-removable elements, prioritizing address and phone, since this record re-seeds broker networks.
3. ThreatWatch tuned to this incident's identifiers and misuse pattern (impersonation and targeting patterns, not generic credential monitoring).