Loading story…
The Uvalde Consolidated Independent School District in Texas has closed schools from September 15-18 due to a ransomware attack affecting essential systems. The attack has disrupted phones, HVAC, camera monitoring, and visitor management, impacting the safety and security of the district. No group has claimed responsibility, and investigations involving the FBI and cybersecurity teams are ongoing.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
3 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcemysanantonio.com
Open sourcedatabreaches.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The University of Texas at San Antonio took multiple IT systems offline after detecting attempted unauthorized activity at the edge of its network, prompting emergency containment measures before the activity reached core systems. The disruption affected online registration, tuition payment services and university phone systems just ahead of the August 19 start of the academic term, while University Technology Solutions worked with external cybersecurity partners to investigate and contain the incident. University officials said there was no evidence at the time of reporting that data had been accessed or exfiltrated, but students, faculty and staff were told to expect instructions to reset their passphrases. The incident adds to a broader pattern of cyber disruptions targeting educational institutions during back-to-school periods, when operational pressure and user activity are high.
Aug 19, 2026
A cyberattack forced Colorado’s Salida School District to shut down its network after the intrusion began at about 6:30 a.m. on June 29 and was detected roughly two hours later. The incident damaged locally stored files on some network-connected devices, disrupted central-office administrative operations, and left some files potentially unrecoverable. The district took all systems offline and retained specialists to investigate the attack and restore services safely. Officials said they had no indication that data had been accessed or exfiltrated at the time of disclosure, but forensic work remained ongoing; the district had not identified the attacker, intrusion vector, initial access method, ransomware involvement, or an extortion demand.
Sep 10, 2026
Educational institutions are increasingly targeted by cybercriminals, with ransomware attacks causing significant operational disruptions and data loss. In the United Kingdom, new figures from Ofqual reveal that while more teachers are receiving cybersecurity training, schools are taking longer to recover from cyber incidents. Only 55 percent of affected schools managed to recover immediately, a decline from the previous year, and 10 percent reported critical damage, nearly double the previous rate. The impact on students and staff is severe, with some schools losing coursework and lesson plans permanently, forcing teachers to recreate resources and disrupting classes for weeks. One unnamed academy trust experienced such extensive damage that staff across the organization had to rebuild schedules and resources from scratch. The human cost is substantial, as students’ academic progress is directly affected by the loss of critical educational materials. Ofqual has responded by urging schools to strengthen their cyber defenses, emphasizing the importance of regular data backups and robust malware protection. In the United States, the South Lyon Community School District was forced to shut down schools after a ransomware attack crippled phone systems and emergency response sub-systems. Although there is no evidence that student or faculty data was compromised in this incident, the attack severely disrupted normal operations and highlighted vulnerabilities in critical infrastructure. According to the Center for Internet Security, 82% of K-12 schools in the U.S. experienced a cyber incident between July 2023 and December 2024, underscoring the widespread nature of the threat. The South Lyon attack was attributed to a well-known ransomware group, though officials have not disclosed the group’s identity. The incident demonstrates that even with increased awareness and training, schools remain vulnerable to sophisticated attacks that can bypass existing defenses. Both UK and US authorities stress that the cost of prevention, including reliable backup and recovery strategies, is far less than the cost of responding to a successful attack. The growing frequency and severity of these incidents have prompted calls for greater investment in cybersecurity measures across the education sector. The loss of access to emergency systems, as seen in South Lyon, raises additional concerns about student safety during critical events. The trend of longer recovery times and more severe outcomes suggests that attackers are employing more destructive tactics, making it harder for schools to restore normal operations. The publication of sensitive data, as referenced in other UK incidents, further illustrates the risks to student privacy and institutional reputation. As schools continue to digitize their operations, the need for comprehensive cybersecurity strategies becomes increasingly urgent. The educational sector’s unique challenges, including limited budgets and legacy systems, make it a prime target for ransomware groups seeking to maximize disruption. Authorities recommend that schools prioritize regular backups, employee training, and incident response planning to mitigate the impact of future attacks. The ongoing wave of ransomware incidents serves as a stark reminder that educational institutions must remain vigilant and proactive in defending against evolving cyber threats.
Jun 29, 2026