Appomattox County Public Schools

Summary

A cyber incident disrupted Appomattox County and its local public school system, prompting a joint investigation with outside cybersecurity experts and notifications to state and federal authorities. Upon discovering the issue, county officials engaged leading external specialists to secure affected systems and determine the cause and scope of the breach. Essential operations, including 911 services, remained functional throughout the response, though administrative offices and the courthouse were temporarily closed before resuming service shortly after. The county committed to providing further updates as the investigation progressed.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On February 1, 2025, Appomattox County, Virginia, publicly reported a cyber incident that affected multiple local organizations, including the Appomattox County Public Schools system. County officials issued the disclosure after discovering the issue, stating that they had begun working directly with the school division to investigate the extent of the attack. The disclosure marked the first public acknowledgment of the incident, with the county indicating it had already taken initial steps to respond before alerting the public.

Upon discovery of the incident, county officials immediately engaged outside cybersecurity experts described as among the nation's leading firms to assist with securing affected systems and determining both the cause and the impact of the attack. In parallel, state and federal authorities were notified of the matter. The county indicated it would work closely with these authorities as the investigation progressed. The statement released by county officials emphasized the dual focus on system remediation and investigative coordination with law enforcement and regulatory bodies.

The county's public statement also addressed continuity of essential services, noting that 911 operations and other critical public safety functions remained operational despite the incident. Administrative operations, however, were temporarily disrupted. County administration offices and the courthouse were closed in the immediate aftermath of the incident and were scheduled to reopen on Tuesday, February 18, suggesting an outage period of roughly two and a half weeks from the initial disclosure. The county committed to providing ongoing updates as more information became available about the scope and impact of the cyber incident, leaving the specific nature of the attack, the identity of any threat actor, and the full extent of the damage to affected systems undisclosed in the initial reporting.

Sources

Sources available to members: 1 source.