Ransomware gang Interlock today claimed responsibility for a cyber attack at Cherokee County School District in South Carolina.
The school district announced it was hit by a cyber attack on March 15, 2025, forcing schools to shut down its network, wi-fi, and several software applications.
By March 31, the network was restored and classes were back to normal, according to school board officials.
Interlock says it stole 624 GB of data from Cherokee County School District during the attack, including the personal data of employees, finances, and tax documents. The group posted images of what it says are documents stolen from the school district.
Cherokee County School District has not verified Interlock’s claim. We do not know what data was compromised, if the district paid a ransom, how much Interlock demanded, or how attackers breached the district’ network.
In response to Comparitech’s questions, Interim Superintendent Thomas White gave the following statement:
“At Cherokee County School District (CCSD), we recognize the importance of protecting our students, parents, and staff, including their personal data. In March, we alerted our school community that we were investigating a cybersecurity event that impacted portions of our information technology (IT) environment. Upon discovery of this incident, we acted quickly and engaged federal and state law enforcement agencies, and leading IT security experts. We worked diligently to minimize the impact of this incident on our day-to-day operations, and we can confirm that our IT environment is essentially fully restored. We are currently assessing the CCSD records impacted by this incident, and we will directly engage with those in the CCSD community who could have been impacted by it. We are proud of the way that the CCSD team has responded to this incident, and we are grateful for the tremendous support we have received from the CCSD community.”
Who is Interlock?
Interlock is a new ransomware gang that first started adding targets to its leak site in October 2024. Since then, it has claimed 11 confirmed ransomware attacks, plus another 11 attack claims that haven’t been acknowledged by the targeted organizations.
Schools are common Interlock targets. In addition to Cherokee County, the group also attacked Aztec Municipal School District, Texas Tech University Health Sciences Center, and Winnebago Public Schools. Texas Tech notified more than 1.4 million people of its breach.
Ransomware attacks on US education
Comparitech researchers have logged 11 confirmed ransomware attacks on US schools, colleges, and other educational institutions since the start of 2025.
Other recent attacks on schools include those on Penn-Harris-Madison School Corporation in Indiana, Life University in Georgia, and Forrest City School District in Arkansas. Ransomware gang Rhysida demanded a $420,000 ransom from Forrest City.
Ransomware attacks on schools and other education facilities can disrupt day-to-day operations such as taking attendance, submitting grades, phone and email communications, billing, payroll, and assignments. Ransomware attacks are often two-pronged: they lock down systems and steal data. Schools that refuse to pay can face extended downtime, lose data, and put students and faculty at increased risk of fraud.
About Cherokee County School District
Cherokee County School District in South Carolina enrolls about 8,000 students in nine elementary schools, three middle schools, and two high schools. Cherokee County sits on the North Carolina border, roughly between Asheville and Charlotte.
