Ransomware gang Rhysida over the weekend claimed responsibility for a December 2024 data breach at Forrest City School District in Arkansas.
The school district announced it suffered a cyber attack on or around December 12, 2024 that forced it to suspend internet service.
Rhysida is demanding the Forrest City pay 5 bitcoin in ransom, worth about $420,000 at time of writing. If the district refuses to pay within seven days, then Rhysida threatens to auction off the stolen data, which appears to include student transcripts, internal memos, and financial documents. To prove its claim, Rhysida posted images to its website of what it says are documents stolen from the school district.
Forrest City School District has not verified Rhysida’s claim. We do not know exactly what data was compromised, if the school district did or will pay a ransom, or how attackers breached the district’s network. Comparitech contacted Forrest City School District for comment and will update this article if it replies.
Who is Rhysida?
Rhysida is a ransomware group that first surfaced in May 2023. Its ransomware can steal data and lock down targeted systems. It then demands a ransom both for deleting stolen data and for a key to restore infected systems.
Since it began, Rhysida claimed responsibility for 84 confirmed ransomware attacks affecting more than 5.3 million records. The group claimed another
101 unconfirmed attacks that haven’t been acknowledged by targeted organizations. Its average ransom demand is $1.05 million.
Forrester City is not the first school hit by Rhysida. In December 2024, the group attacked Pembina Trails School Division in Winnipeg and Oral Roberts University in Tulsa.
So far in 2025, the group claimed confirmed attacks on The Agency (London) and Best Collateral, Inc.
Ransomware attacks on US education
In 2024, Comparitech researchers logged 73 confirmed ransomware attacks on US schools, colleges, and other educational institutions. That figure is a sharp decrease from the year prior, which saw 124 such attacks. In 2025 so far, we’ve recorded 10 more.
The average ransom across all attacks in $690,000.
Other recently-confirmed ransomware attacks on US schools include:
Ransomware attacks on schools and other education facilities can disrupt day-to-day operations such as taking attendance, submitting grades, phone and email communications, billing, payroll, and assignments. Ransomware attacks are often two-pronged: they lock down systems and steal data. Schools that refuse to pay can face extended downtime, lose data, and put students and faculty at increased risk of fraud.
About Forrest City School District
Located in Forrest City, Arkansas, the school district also serves the towns of Caldwell, Colt, Madison, and Widener in St. Francis County. It consists of three elementary schools, one middle school, one high school, one pre-kindergarten school, and one alternative school. The district enrolls about 2,300 students and employs about 300 staff, according to external sources.
Source link
-
-
-
-
-
-
-
-
