Loading story…
Slate Valley Unified School District in Fair Haven, Vermont, voted not to pay a ransom demand after responding to a security incident that began September 3, according to an October 4 DataBreaches report highlighted by Malware News. The report indicated that the Kairos threat actors were likely to leak data following the district’s refusal to pay.
On October 2, Kairos contacted DataBreaches to dispute the district’s belief that student data had not been compromised. The available reporting does not establish whether student information was accessed or stolen, or whether any data has been published. The district’s reported refusal leaves potential data exposure as an unresolved risk, distinct from the attackers’ unverified claims about student records.
See the actors and campaigns active against you right now.
4 events from the most recent confirmed update back to the earliest known activity.
On October 2, Kairos threat actors contacted DataBreaches to challenge the district's belief that student data had not been compromised. The excerpt does not establish whether student data was exposed.
Slate Valley Unified School District in Fair Haven, Vermont, began responding to a security incident on September 3.
The linked article's title reports that the district voted not to pay the ransom demand. It characterizes a potential Kairos data leak as likely, not confirmed.
Slate Valley Unified School District stated that it believed student data had not been compromised. The provided content does not independently confirm that assessment.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Slate Valley Unified School District suffered a ransomware attack discovered on September 3 that compromised a district server and teachers’ personal information. The incident disrupted internet access and internal platforms for approximately a week before cybersecurity contractors helped restore connectivity. Attackers identifying themselves as the **Kairos ransomware group** demanded hundreds of thousands of dollars and threatened to leak personal information they claimed belonged to more than 1,500 employees; that claimed scope has not been independently confirmed. The FBI is investigating, and the school board said the district had made no ransom payments. District officials are notifying staff and working with outside specialists to identify affected individuals, while the Vermont Agency of Education has warned recipients not to engage with suspicious communications. Separately, TRM Labs has warned of impersonation scams in which malicious actors falsely claim affiliation with the company and offer fraudulent fund-recovery services, highlighting an additional fraud risk distinct from the school district incident.
Oct 3, 2026
A U.S. government entity reportedly paid about **$1 million** in Bitcoin to the **Kairos** group after attackers allegedly stole more than **2 TB of data** and threatened to publish it. A Ransom-ISAC case study said the incident showed no confirmed signs of file encryption, a ransomware locker, or any decryption demand, indicating a **pure data-theft extortion** operation rather than a traditional ransomware attack. Negotiations reportedly lasted about a month, with Kairos reducing its demand from **$3 million** to a final payment of roughly **9.44 BTC**. The victim was not formally identified, but chat logs and file-name clues cited in the reporting align with **Union County, Ohio**, which disclosed a 2025 breach affecting **45,487** residents and staff, though neither the county nor Kairos confirmed the connection. Blockchain tracing found the payment was quickly split and routed toward deposit addresses linked to **Bybit**, **OKX**, and **BELQI**, offering investigative leads but not definitive attribution. The case underscores the rise of **encryption-less extortion**, where organizations face pressure to pay despite having no technical way to verify that stolen data was actually deleted.
Jul 10, 2026
A breach tied to **PowerSchool**, a widely used K-12 software provider, exposed student and teacher information from school districts across the U.S., including New Jersey districts where officials said data on students and educators was stolen in a nationwide cyberattack. Reporting on the incident said the compromise affected records held by schools using the platform, raising concerns about the scale of exposure across the education sector and the security of sensitive K-12 data. Separately, **Spring Lake Park Schools** in Minnesota canceled classes and shut down technology systems after an outside actor gained unauthorized access to district networks in what officials described as a suspected ransomware incident. The disruption affected classes, child care, community education, and after-school programs, while the district worked with third-party cybersecurity experts, state law enforcement, and the **FBI** to contain the intrusion and restore operations; officials later said classes would resume and that they had no evidence at that point that personal information had been affected.
Jun 29, 2026