A threat actor going by Spirigatito has posted a leak of Den kulturelle skolesekken (DKS, "The Cultural Schoolbag") on a public cybercrime forum, signing the post "Breached by @👑 Spirigatito" and addressing the forum community directly with the line "Today I am leaking DenKulturelles database." DKS is one of the largest national cultural-policy programmes in the world, established in 2001 and operated by the Ministry of Culture agency Kulturtanken (Arts for Young Audiences Norway) since 2016. The programme delivers professional film, literature, music, performing arts, visual arts, and cultural-heritage experiences to every school pupil in Norway from first grade through year 3 of upper secondary, in cooperation with all county councils (fylkeskommune) and municipalities (kommune).

According to the listing, three breaches affect 1,389,534 rows in total, distributed across three structurally distinct datasets. Each is represented by a JSON sample in the forum post. The data categories exposed include:

• User & Performer RecordsApproximately one million rows containing id, is_performer flag, performer_branch_office_ids, first_name, last_name, email, phone_number_formatted, address (postal_code, locality, street), nationality (NO, SE), and language code (nb for Norwegian Bokmål). Visible sample emails span Norwegian county-council domains including telemarkfylke.no, vtfk.no (Vestfold Telemark), and bergen.kommune.no, alongside private addresses on hotmail.com and monlyse.org.
• Internal CommunicationsFull message bodies between DKS coordinators and county-level cultural officers, with sender_user_name, sender_name (e.g. "Agder fylkeskommune", "Vestland fylkeskommune", "Nordland fylkeskommune", "Oslo kommune", "Kristiansand kommune"), recipients_stringified, subject lines, content_text, topic_id, related_entity_ids, branch_office_id, and Unix time_sent_int timestamps from 2023.
• Programme & Tour PlanningRecords for individual cultural productions including cultural_institution_name (e.g. Vestfoldmuseene, Vikinggården på Borre), production names (Vitsen med GRENSER, VGS-bestilling 26/27, Mia har forlatt chatten), branch_office_id, performer_count, tour_staff_count, budget_total / budget_tour / budget_development, year_level_minimum / year_level_maximum (school grades), program_seasons (e.g. "Høst 2026, Vår 2027"), location_type, and is_published / is_deleted flags.
• Tour Logistics & Travel QuotesFragments of internal correspondence visible in the sample reference detailed travel logistics including flight quotes (Bergen to Sandefjord, kr 2480 and kr 3079) and tour scheduling for cultural productions across multiple Norwegian counties.

The sample data is internally coherent: phone numbers carry the Norwegian +47 country code, addresses include real postal codes for Skien (3736), Bø i Telemark (3801), Porsgrunn (3912), and other Norwegian locations, and the references to fylkeskommune and kommune entities map to the actual administrative divisions of Norway. The intermingling of government employee PII, private citizen contact details, and rich internal communications makes this a high-impact incident for Kulturtanken specifically and for any of the eleven Norwegian county councils whose DKS coordinators appear in the dataset.