West Virginia’s Harrison County Board of Education has been added to the data leak site of ransomware gang SafePay. It alleges to have stolen 26 GB of data. This comes after the Board of Education said it suffered a “cybersecurity incident” on January 18, 2025, which led to school closures.
Its statement, issued on January 23, says: “On Saturday, January 18, our school district experienced a cybersecurity incident that involved unauthorized access to some of our computer systems. As soon as we learned of the incident, we immediately began an investigation and temporarily disabled the network over the holiday weekend. We also engaged outside cybersecurity experts to assist in thoroughly assessing the situation and ensuring the security of our systems.”
The school was closed on Tuesday 21 and Wednesday 22 (having been closed for Martin Luther King Jr. Day on January 20) before having at-home learning on Thursday 23 and a delayed start on Friday 24.
Harrison County Board of Education hasn’t disclosed the nature of this incident or confirmed SafePay’s claims. Comparitech has contacted it for further information, including whether a ransom was demanded/paid and how many people are potentially impacted by this incident. We will update this article if it responds.
Who is SafePay?
SafePay first started adding victims to its data leak site in November 2024. Since then, we’ve tracked 12 confirmed and 62 unconfirmed attacks via this group. The group uses LockBit-based ransomware and appears to follow a double-extortion technique whereby a ransom is demanded to decrypt systems and delete stolen data.
Two of its other confirmed victims are also US educational institutions: Elwood Community School Corporation (hit in November 2024) and Starkville-Oktibbeha Consolidated School District (breached in December 2024 but no ransom paid).
SafePay’s other victims are located all over the world and a variety of industries, from manufacturers and construction companies to government and healthcare organizations.
Ransomware attacks on the US education sector
Last year, we noted a significant decline in ransomware attacks on US schools, colleges, and universities (dropping from 123 in 2023 to 69 in 2024). But with four attacks confirmed this year already, and a number of claims from ransomware groups on the education sector, this could change.
Addison Northwest School District, the University of Oklahoma, and Jefferson School District 251 have also confirmed attacks this year. Following its attack this week, Jefferson School District 251 also had to cancel classes. No groups have claimed this attack as of yet but ThreeAM claimed Addison and Fog claimed the University of Oklahoma.
We have also noted 14 unconfirmed attacks on US schools and colleges this year so far.
About Harrison County Board of Education
Located in Clarksburg, West Virginia, Harrison County Board of Education has 24 schools and is home to nearly 10,000 students.
