Norman Public Schools

Summary

Norman Public Schools experienced a malicious ransomware attack disrupting network operations, prompting collaboration with third-party cybersecurity experts and law enforcement to resolve the incident. The district advised students and parents to immediately discontinue use of all issued devices, disconnect them from home networks, and power them down until further guidance, while committing to provide ongoing updates as recovery efforts progressed.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On November 4, 2022, Norman Public Schools (NPS) publicly disclosed an active malicious ransomware attack disrupting its networks. The district's technology services team immediately engaged in response efforts, collaborating with third-party cybersecurity experts and law enforcement agencies to contain and resolve the incident. NPS officials characterized the event as a significant operational disruption, though specific technical details about the ransomware variant, initial attack vector, and full scope of compromised systems were not disclosed in public communications. District spokesperson Wes Moody formally notified parents and staff through direct messaging, emphasizing the severity of the situation while assuring stakeholders that response teams were prioritizing restoration efforts. The attack prompted immediate network isolation measures, though the district did not specify whether the ransomware encrypted data, exfiltrated sensitive information, or disrupted particular operational systems beyond general network functionality.

In response to the attack, NPS issued explicit directives instructing students and parents to power down all district-issued devices immediately and maintain disconnection from home networks until further notice. This containment strategy aimed to prevent potential malware propagation through connected devices and mitigate secondary infection risks across residential networks. The district committed to providing ongoing updates as forensic investigations progressed, though subsequent public disclosures regarding attack attribution, data compromise status, or full service restoration timelines remained absent from available communications. No ransomware group claimed responsibility through public leak sites during the initial disclosure period, and NPS did not reference ransom demands or negotiation status. The operational disruption affected standard school communications and technology-dependent activities district-wide, with recovery efforts continuing through coordinated work between internal IT personnel and external cybersecurity specialists under law enforcement oversight.

Sources

Sources available to members: 2 sources.