Loading story…
Slate Valley Unified School District suffered a ransomware attack discovered on September 3 that compromised a district server and teachers’ personal information. The incident disrupted internet access and internal platforms for approximately a week before cybersecurity contractors helped restore connectivity. Attackers identifying themselves as the Kairos ransomware group demanded hundreds of thousands of dollars and threatened to leak personal information they claimed belonged to more than 1,500 employees; that claimed scope has not been independently confirmed.
The FBI is investigating, and the school board said the district had made no ransom payments. District officials are notifying staff and working with outside specialists to identify affected individuals, while the Vermont Agency of Education has warned recipients not to engage with suspicious communications. Separately, TRM Labs has warned of impersonation scams in which malicious actors falsely claim affiliation with the company and offer fraudulent fund-recovery services, highlighting an additional fraud risk distinct from the school district incident.
See the actors and campaigns active against you right now.
8 events from the most recent confirmed update back to the earliest known activity.
Slate Valley Unified School District discovered the attack on September 3 after teachers could not log in to Microsoft Windows. Attackers compromised a district server and obtained teachers’ records, disrupting internet access and internal platforms, including PowerSchool.
After the district alerted it to the incident, the Vermont Agency of Education reported that emails using the name “Kairos Support Group” had reached staff and community members. It urged recipients not to engage with suspicious messages and to preserve and forward them to the district.
Slate Valley notified staff about the breach and engaged outside specialists to identify affected current and former teachers and provide individual notifications. The superintendent said the district was paying cybersecurity firms hundreds of thousands of dollars to determine whose information had been compromised.
The school board denied making any ransom payments in response to the attack.
The FBI’s Albany office confirmed that it was investigating and assisting with the incident. The FBI advised the district against paying because ransom payments incentivize attackers and can encourage future attempts.
Individuals identifying themselves as the Kairos ransomware group emailed media outlets claiming possession of staff information and threatening to leak Social Security numbers, home addresses, and other confidential records. The claimed total of more than 1,500 affected employees was not confirmed by the district.
Attackers demanded hundreds of thousands of dollars in ransom from the district. Superintendent Brooke Olsen-Farrell declined to disclose the exact amount while the investigation remained ongoing.
Outside cybersecurity contractors helped restore Slate Valley’s connectivity after approximately one week without internet access and internal platforms.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A breach tied to **PowerSchool**, a widely used K-12 software provider, exposed student and teacher information from school districts across the U.S., including New Jersey districts where officials said data on students and educators was stolen in a nationwide cyberattack. Reporting on the incident said the compromise affected records held by schools using the platform, raising concerns about the scale of exposure across the education sector and the security of sensitive K-12 data. Separately, **Spring Lake Park Schools** in Minnesota canceled classes and shut down technology systems after an outside actor gained unauthorized access to district networks in what officials described as a suspected ransomware incident. The disruption affected classes, child care, community education, and after-school programs, while the district worked with third-party cybersecurity experts, state law enforcement, and the **FBI** to contain the intrusion and restore operations; officials later said classes would resume and that they had no evidence at that point that personal information had been affected.
Jun 29, 2026
A U.S. government entity reportedly paid about **$1 million** in Bitcoin to the **Kairos** group after attackers allegedly stole more than **2 TB of data** and threatened to publish it. A Ransom-ISAC case study said the incident showed no confirmed signs of file encryption, a ransomware locker, or any decryption demand, indicating a **pure data-theft extortion** operation rather than a traditional ransomware attack. Negotiations reportedly lasted about a month, with Kairos reducing its demand from **$3 million** to a final payment of roughly **9.44 BTC**. The victim was not formally identified, but chat logs and file-name clues cited in the reporting align with **Union County, Ohio**, which disclosed a 2025 breach affecting **45,487** residents and staff, though neither the county nor Kairos confirmed the connection. Blockchain tracing found the payment was quickly split and routed toward deposit addresses linked to **Bybit**, **OKX**, and **BELQI**, offering investigative leads but not definitive attribution. The case underscores the rise of **encryption-less extortion**, where organizations face pressure to pay despite having no technical way to verify that stolen data was actually deleted.
Jul 10, 2026
U.S. authorities warned that malicious cyber actors were actively targeting K-12 schools and other educational institutions as remote learning expanded, using ransomware, malware, phishing, DDoS attacks, and video-conference intrusions to disrupt classes and steal sensitive data. The joint FBI, CISA, and MS-ISAC advisory said schools had become targets of opportunity, with ransomware incidents rising sharply and commonly involving **data theft and extortion**; families observed in attacks included `Ryuk`, `Maze`, `Nefilim`, `AKO`, and `Sodinokibi/REvil`, while malware such as `ZeuS` and `Shlayer` also affected the sector. Separate reporting on criminal forums showed underground sellers offering remote access to compromised schools and universities in the U.S., U.K., Australia, Israel, and Germany, with listings priced from **$200 to $17,000** based on victim size and privilege level. The activity coincided with leaked credentials, exposed FTP servers, and student-data incidents tied to education and e-learning platforms, reinforcing concerns about weak remote-access security, exposed `RDP` and `SMB` services, end-of-life software, and third-party edtech risks; officials urged patching, MFA, network segmentation, offline backups, DDoS protections, tighter conferencing controls, and stronger vetting of service providers.
Aug 15, 2026