Ransomware gang Fog yesterday claimed responsibility for a February 2025 data breach at Williamsburg-James City County Schools in Virginia. The group is demanding an undisclosed amount be paid in ransom in exchange for stolen data.
WJCC announced it was hit by a cyber attack on February 9 and that systems were restored by February 14. An investigation of the attack and what data was compromised is still ongoing, and WJCC has not publicly disclosed a data breach.
In a post on its website, Fog says it stole 27.7 GB of data from WJCC. The school district has not verified Fog’s claim.
We do not yet know what data was compromised, if WJCC did or will pay a ransom, how much Fog demanded, or how attackers breached WJCC’s network. Comparitech contacted WJCC for comment and will update this article if it replies.
“These investigations typically happen over several weeks but understanding how this happened and restoring all operations are priorities,” says a FAQ about the attack on the school district’s website.
Who is Fog?
Fog is a ransomware gang that first started claiming attacks on its website in July 2024. It has a history of targeting US schools but is not limited to them. In addition to encrypting files, Fog also steals data and targets development environments, such as repositories stored on GitLab.
Fog has claimed 16 confirmed ransomware attacks since it began, plus another 155 unconfirmed claim that have not been acknowledged by the targeted organizations.
Of Fog’s six confirmed attacks in 2025, five were against schools:
- Williamsburg-James City County Schools in Virginia
- University of Oklahoma
- Aurora Public Schools in Colorado
- University of Notre Dame Australia
- Saint George’s College in Chile
Ransomware attacks on US education
So far in 2025, Comparitech researchers logged eight confirmed ransomware attacks against US schools, colleges, and other educational institutions. In addition to those mentioned above, other such attacks include:
- Addison Northwest School District in Vermont attacked by ThreeAM in January
- Jefferson School District 251 in Idaho hacked by unknown attackers in February
- Harrison County Board of Education in West Virginia attacked by SafePay in January
- Laurens County School District 56 in South Carolina attacked by Medusa in February
- Penn-Harris-Madison School Corporation in Indiana hacked by unknown attackers in March
Ransomware attacks on schools and other education facilities can disrupt day-to-day operations such as taking attendance, submitting grades, phone and email communications, billing, payroll, and assignments. Ransomware attacks are often two-pronged: they lock down systems and steal data. Schools that refuse to pay can face extended downtime, lose data, and put students and faculty at increased risk of fraud.
About Williamsburg-James City County Schools
Williamsburg-James City County Schools, known as WJCC or WJC, is a public school district based in Williamsburg, Virginia. It consists of 16 schools: nine elementary, four middle, and three high schools. WJCC employs nearly 2,000 people and enrolls more than 11,000 students.
