Cyber Incident Victim: Beaverhead County High School
Date:
Nov 2021
Location:
United States of America
Summary
Beaverhead County High School experienced a ransomware attack by the Avos Locker group, which claimed to have exfiltrated data and threatened to leak it unless negotiations occurred. The attackers provided limited proof of compromise, primarily showcasing athletic injury procedures but no identifiable student or staff information. The incident caused significant operational disruptions, including an extended email system outage that necessitated alternative communication methods. School board discussions referenced addressing a computer system disruption, though no specific resolutions were publicly documented. Despite the attackers acknowledging the institution's small size, they pursued ransom demands, emphasizing the potential release of all acquired data if unmet. The school did not publicly disclose further details about the attack's scope or mitigation efforts.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
In early November 2021, Beaverhead County High School in Montana experienced a ransomware attack claimed by the Avos Locker group. The attackers listed the school on their dark web leak site on November 20, though the exact intrusion date remains unspecified. Avos Locker provided limited proof of data exfiltration, uploading only one document identifiable as belonging to the school—athletic injury response procedures. No student records, employee information, or other sensitive datasets were disclosed as evidence. The threat actors acknowledged the district's small size—fewer than two dozen teachers and several hundred students—but demanded ransom negotiations under threat of leaking all stolen data. The school's first public indication of technical issues appeared in a website announcement dated approximately October 14, 2021, stating the email system had been offline since the previous Sunday and would remain inoperative indefinitely, with promises of robocall updates that never materialized on the public transcript feed.
The school board addressed the incident during a November 12 meeting, listing "computer system disruption" on its agenda, but no minutes or resolutions from that discussion were published. District administrators did not respond to media inquiries about the attack's scope, recovery efforts, or communications with the threat actors. Avos Locker similarly provided no additional details when contacted regarding their targeting rationale or the nature of exfiltrated data beyond their initial dark web post. Operational impacts included prolonged email system unavailability, forcing stakeholders to use phone calls for essential communications. The ransomware group maintained public pressure through their leak site but had not escalated threats by the time of initial reporting. No further updates regarding data leaks, ransom payments, or system restoration were confirmed in the available source material.