Skip to content
DysruptionHub
Sign in Subscribe

Ransomware disrupts Addison Northwest school systems

Summary

Addison Northwest School District logo

ThreeAM ransomware compromised Addison Northwest School District’s servers in January 2025. Officials reported restoring servers from backups by Jan. 13.

Key facts

Timeline

  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted locations

Organization types

Critical infrastructure sector

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Resolved
Incident confidence:
High
Ransomware:
High
Attribution:
High

Attack mechanisms

  • Ransomware

    Malware that encrypts systems or data, typically accompanied by a ransom demand.

Data impacts

  • Data unavailable

    Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.

Operational impacts

  • Partial service outage

    A service, system, platform, or operational capability remained available only in part or with significant limitations.

  • Network outage

    Internal or external network connectivity was unavailable or materially impaired.

  • Internet access disruption

    The organization lost or materially restricted internet connectivity.

  • Email disruption

    Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.

  • Internal systems unavailable

    Internal business, administrative, operational, or staff-facing systems were unavailable.

  • Records access disruption

    Staff, customers, patients, students, residents, or other users could not access records or case information normally.

Extortion indicators

  • Leak-site listing

    The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.

  • Public leak threat

    The actor explicitly threatened to publish or publicly release victim data or incident details.

  • Payment instructions provided

    The actor supplied cryptocurrency addresses, payment procedures, transaction requirements, or other instructions for satisfying the demand.

Incident narrative

What happened

Addison Northwest School District in Vermont identified a cyberattack on Jan. 7, 2025. The superintendent confirmed ransomware in contemporaneous reporting. Employees lost access to servers, and internet service stopped at three schools and the central office.

At the Jan. 13 board meeting, Superintendent Sheila Soule and technology administrator Tim White said multiple devices had been compromised by ThreeAM, also called 3AM. They placed the incident between the evening of Jan. 6 and the morning of Jan. 7. A ransom note on affected machines directed the district to a dark-web site for information about recovering its files.

Officials said a legacy payroll server and a data server containing staff folders had been compromised, potentially exposing banking information and personal material. The minutes also relayed an FBI account that the attackers claimed to have encrypted and stolen data and threatened to sell it.

Operational significance

District officials said all servers had been restored using Jan. 3 backups by the Jan. 13 meeting, with user files available and minimal loss. The backup date does not establish when the intrusion began. Google Drive and the listed Apple, Chromebook and Android devices were unaffected.

A Jan. 22 student report to the board described a quick response and little interruption to learning. The newspaper’s year-end review described several days without internet and email service. These accounts establish disruption and recovery without identifying the exact day every service returned.

Confidence and uncertainty

The named district officials’ technical account establishes ThreeAM ransomware involvement with high confidence. A ransomware.live listing for anwsd.org, observed Jan. 15, separately records a ThreeAM claim. Identifying the ransomware family does not identify the individuals who operated it.

The compromised servers created a risk to sensitive information. The attackers’ reported assertion of data theft and a sale threat remains distinct from an independently established inventory of stolen information.

Analytic gaps

The initial access method, precise earlier intrusion period, exact final restoration date, affected data fields and population, and any ransom amount or payment remain unresolved. The Jan. 6–7 incident window does not support selecting a precise starting day. The separate Addison Central School District breach discussed in the year-end review is outside this incident.

Threat actor and claim

ThreeAM

Listed as: anwsd.orgSource: ransomware.liveDiscovered:

Claim details

Ransomware.live observed a ThreeAM listing for anwsd.org on Jan.15,2025; that is the tracker observation, not the original actor publication or attackdate. Separately, the district’s Jan.13boardminutes identify a ThreeAM/3AM ransomware exploit on multipledevices and a ransomnote; they relay an FBI account of attacker claims of encryption, theft and sale. Officialfamilyidentification supports involvement independently of listing, while actualstolencategories/count and individualoperators remain unverified. Reuse this existingclaim and canonicalactor; stale fourschoolmarketingtext is not incident scope.

Organizations involved

Impacted locations

  • Addison Northwest School District, Vermont

    The district’s official About/SchoolBoard pages establish five-communityeducationremit. Exact2024–25NCES5000398unifieddistrictpolygon represents this jurisdiction. This serviceoverlay identifies the affected schooldistrict’s physicalremit, not anoutageofallmunicipalservices/residents orallcounty. Pairedorganizationservice_area/incidentimpacted_area maintained; physicaloffice/schools modeledseparatelybymunicipality.

    Source

  • Ferrisburgh, Vermont

    Ferrisburgh Central School at 56 Little Chicago Road is an affected district school outside Vergennes. Its official page and an actual-address Census match place it in Ferrisburgh town, Addison County. OSM relation 8890591 identifies the municipal boundary. Reuse the town as the school’s physical anchor; do not create a school-building location or infer that Ferrisburgh town government was attacked. The district’s original notice reports the schools’ internet and server interruption.

    Source

  • Vergennes, Vermont

    Vergennes contains the affected district central office at 11 Main Street, Suite B100, and its Vergennes school campuses. The actual-office Census match confirms Vergennes city5074650 in Addison County50001; OSM relation199094 identifies the city boundary. This is a physical municipal anchor for district sites. The separate Ferrisburgh Central School site is represented by its own verified Ferrisburgh town relationships. District systems disruption does not establish a city-government attack or a municipality-wide service outage.

    Source

Sources

January 2025 Year in Review
Addison IndependentPublished: Retrieved:
  • Type: News Report
  • Stance: Report
  • Platform: Website
  • Medium: Web Page
Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.