Yazoo County School District

Summary

A Mississippi school district experienced unauthorized access to its IT systems, leading to encrypted files and a subsequent ransomware incident. The organization took systems offline, engaged cybersecurity experts, and notified federal law enforcement while working to restore operations. A $300,000 payment was authorized to recover encrypted data, though critical functions like payroll, cafeteria services, and physical security systems remained unaffected throughout the event. The district implemented enhanced security measures during recovery and maintained limited academic operations under pandemic restrictions while refraining from disclosing specific intrusion methods or compromised data pending investigation.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

The Yazoo County School District in Mississippi experienced a cyber incident beginning on October 12, 2020, when unauthorized actors accessed its information technology systems. Superintendent Dr. Ken Barron publicly confirmed the attack after the district detected anomalous activity affecting certain network devices. The threat actors deployed malware that encrypted files, disrupting normal IT operations. In response, the district immediately took all affected systems offline to contain the breach and initiated an internal investigation. The district engaged national cybersecurity firms to assist with forensic analysis and recovery efforts while concurrently reporting the incident to federal law enforcement authorities. Barron emphasized the district's priority was restoring secure operations while maintaining educational continuity under existing COVID-19 pandemic restrictions, with classrooms continuing modified operations throughout the incident response period.

The school board subsequently voted to approve a $300,000 payment to an unspecified company to facilitate recovery of the encrypted data, though the exact nature of this transaction was not detailed in public statements. Barron confirmed critical operational systems including staff payroll processing, cafeteria transaction systems, and integrated security systems for phones, fire alarms, and burglary detection remained unaffected throughout the incident. The district implemented additional cybersecurity measures across its network environment to enable safe device usage and accelerate restoration of normal IT services. Barron declined to specify the attackers' entry methods or whether any sensitive data was compromised, citing the ongoing federal investigation and advice from cybersecurity experts to limit public commentary. The district committed to providing necessary notifications in compliance with state and federal regulations if evidence of personal data exposure emerged during forensic examinations.

Sources

Sources available to members: 1 source.