Hackers give Botetourt County Schools 2 weeks to pay ransom after cyber attack

Ransomware gang Qilin today took credit for a cyber attack on Botetourt County Public Schools earlier this month and demanded the district pay a ransom by June 12, 2025.

On May 13, 2025, superintendent Jonathan Russ sent a message to families in the Virginia school district saying that a cybersecurity incident disrupted some of the district’s IT systems.

Qilin took credit for the attack on its website, saying it stole 315 GB of data from Botetourt County Public Schools. It’s demanding an undisclosed amount in ransom from BCPS by June 12, or else it will release the allegedly stolen data to the public. Qilin claims to have stolen contracts, payroll documents, details of district employee’s direct deposit accounts, and private correspondence from the district.

Botetourt County Public Schools has not verified Qilin’s claim. We do not yet know if the school did or will pay a ransom, what data was compromised, how much Qilin demanded, or how attackers breached the district’s network. Comparitech contacted BCPS for comment and will update this article if it replies.

Who is Qilin?

Qilin is a ransomware gang that began claiming responsibility for attacks on its data leak site in late 2022. Based in Russia, Qilin mainly targets victims through phishing emails to spread its ransomware. It launched in August 2022 and runs a ransomware-as-a-service business in which affiliates pay to use Qilin’s malware to launch attacks and collect ransoms.

Qilin has claimed credit for 26 confirmed ransomware attacks so far this year, plus 201 unconfirmed claims that haven’t been acknowledged by the targeted organizations.

At the same time that Qilin claimed the attack on BCPS, it also took credit for an attack on Logan University that remains unconfirmed. In April 2025, Qilin attacked Western New Mexico University and defaced its website.

Ransomware attacks on US education

Comparitech researchers have logged 19 confirmed ransomware attacks on US schools, colleges, and other educational institutions in 2025 to date.

Earlier this month, ransomware gangs also hit Coweta County School System in Georgia, Bartlesville Public Schools in Oklahoma, and Kalamazoo Public Schools in Michigan.

The education sector takes longer than any other to report data breaches to victims: 4.8 months on average.

About Botetourt County Public Schools

Botetourt County Public Schools consists of seven elementary schools, two middle schools, two high schools, and a vocational school in and around Finacastle, Virginia. It enrolls more than 4,000 students, according to external sources.