Cyber Threat Actor: Two Sherman High School students

The threat actor is identified as two Sherman High School students, operating under the alias of 'Two Sherman High School students,' which is the only name used in public reports to describe the individuals involved. They are located in the United States, specifically in the city of Sherman, Texas, where they attended the local high school. No further personal identifiers, such as real names, ages, or affiliations with any organization, have been disclosed in the available sources. Their activity came to light in November 2020 when they were implicated in a data breach that affected the Sherman Independent School District. The alias reflects the sole publicly available identifier for the individuals, as no additional monikers or group names have been associated with them.

The actors targeted the education sector by gaining unauthorized access to Sherman Independent School District’s private files, which contained student records. The compromised data included students’ full names and Social Security numbers, both classified as personally identifiable information under U.S. privacy regulations. The breach was described as district‑wide, indicating that multiple records across various schools within the Sherman ISD system were exposed. Sherman ISD notified parents through an official letter that confirmed the exposure of this sensitive information and outlined the steps being taken in response.

Public reporting does not specify the malware families, exploit tools, or initial access vectors used by the two students to obtain entry to the district’s files. No details about tooling style, custom scripts, or particular techniques have been made available in the sources consulted for this profile. Consequently, the exact method by which the students accessed the private files remains undocumented in the open‑source material, leaving the technical approach unspecified.

Attribution to any state‑sponsored entity, criminal consortium, or larger hacking group has not been established; the actors are described solely as two high school students acting independently. The Sherman ISD incident represents the only publicly reported operation linked to this actor, serving as a representative example of their activity. Law enforcement initiated a police investigation following the disclosure, and the case was communicated to the affected community via the district’s outreach and official statements.