Jerome School District

Summary

The Jerome School District experienced a ransomware attack that disrupted internet and phone services, discovered by its IT director upon arrival at work. The incident occurred during early morning hours, with systems compromised by malicious software potentially introduced through a downloaded file or email attachment, leading to operational disruptions across district networks.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

The Jerome School District experienced a ransomware attack on December 11, 2017, disrupting critical systems during early morning hours. At approximately 3:00 a.m., malicious software activated within the district's network infrastructure, though the precise intrusion method remained unclear. IT Director Chris Gibson discovered the incident upon arriving at work at 6:30 a.m., when he found both internet connectivity and telephone services non-functional. The ransomware's activation caused immediate operational paralysis across district communications systems. No specific details were provided regarding the ransomware variant or whether data encryption occurred beyond service disruption. District officials did not initially disclose whether attackers demanded payment or established communication.

Technical investigation revealed the attack originated during off-hours, minimizing immediate staff awareness of the compromise. Gibson publicly acknowledged uncertainty regarding the infection vector, stating it could have involved either a malicious email attachment or a compromised downloaded file. The incident impacted administrative and operational functions district-wide, though classroom activities appeared unaffected based on available reports. No information was disclosed regarding the number of affected devices, data recovery processes, or potential data exfiltration. The district's public communications emphasized service disruption as the primary consequence without confirming whether personal data was compromised.

Sources

Sources available to members: 1 source.