Two Sherman High School students

Profile narrative

The threat actor is described as two individuals identified as Sherman High School students. No personal names or additional aliases have been disclosed in public reporting. They are located within the United States, specifically associated with the Sherman Independent School District in Texas. Their identification came from the district’s internal review and subsequent law enforcement involvement. Public sources refer to them solely by their status as high school students.

Their known activity is confined to the education sector, targeting a single public school district. The incident involved unauthorized access to district‑wide private files maintained by Sherman ISD. The compromised data included students’ full names and Social Security numbers, as noted in the district’s communication to parents. The breach affected the entire district rather than isolated schools or departments. No evidence indicates that the actors targeted other sectors, industries, or geographic regions beyond Sherman ISD.

The reported technique consisted of gaining direct access to private files containing personally identifiable information. No malware families, exploit tools, or specific initial‑access vectors were mentioned in the available sources. The activity appears to have been limited to file retrieval rather than the deployment of malicious software or persistence mechanisms. Details about how the students obtained access were not disclosed in the reporting. Consequently, the attack vector remains unspecified in the public domain.

Attribution to any state‑sponsored group, criminal consortium, or broader affiliate network has not been established. The actors are not linked to any known threat‑intelligence clusters, hacking forums, or prior campaigns. No formal nexus to a government entity or organized crime organization can be inferred from the evidence. Their association remains limited to the two individuals identified as high school students.

The Sherman ISD data breach of November 20, 2020, represents the only publicly documented operation associated with these individuals. The incident was covered by local media outlets such as News12 and reported on databreaches.net. The breach resulted in the exposure of student personal data and prompted a police investigation and parental notification letter. No further campaigns or follow‑on actions have been attributed to them in open sources. This incident stands as the sole confirmed example of their activity.

Incidents

Attributed incidents are available to members.