Alcorn School District disabled its network March 1 after suspicious activity disrupted certain systems and threatened scheduled testing. LockBit later claimed the Mississippi district and demanded an undisclosed ransom, but the district did not confirm ransomware, actor responsibility, encryption or data theft. No later operational-impact notice or formal restoration statement was found, and the incident is presumed resolved.
The organization publicly identifies the event as cyber-related. The organization publicly documents the resulting service disruption.
The incident is confirmed to be cyber-related, but the specific attack mechanism is unknown.
The incident is cyber-related, but available evidence does not establish whether or how data was affected.
A service, system, platform, or operational capability remained available only in part or with significant limitations.
Internal or external network connectivity was unavailable or materially impaired.
Internal business, administrative, operational, or staff-facing systems were unavailable.
Appointment, booking, reservation, dispatch, staffing, or other scheduling functions were unavailable or impaired.
Instruction, student services, school administration, learning platforms, transportation, or other educational operations were materially affected.
The victim received a demand for payment in exchange for restoring access, decrypting systems, preventing disclosure, or stopping another threatened action.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
The actor imposed a deadline or public countdown before increasing the demand, publishing data, deleting keys, or taking another threatened action.
Alcorn School District temporarily disabled its network March 1 after detecting suspicious activity that had disrupted certain systems. The district’s public notice said the shutdown could affect scheduled testing while third-party specialists investigated. We reported the disruption March 3.
Comparitech reported that LockBit listed “Alcorn Schools” March 10 and demanded an undisclosed ransom within two weeks. The listing establishes a public claim, but the district did not confirm ransomware, LockBit involvement, encryption or data theft.
The district described disabling its network, not isolating only one device or application. That action disrupted certain networked systems and created a potential effect on student testing.
The district’s current school directory lists nine schools and centers across four geographic locations: Alcorn Central elementary, middle and high schools in Glen; Kossuth elementary, middle and high schools in Kossuth; Biggersville Attendance Center in Biggersville; and the career and technology center, alternative education center and district administration in Corinth. The Biggersville and Kossuth campuses use Corinth mailing addresses but are physically outside the city in their namesake communities.
The district disclosed suspicious activity and a defensive network shutdown March 1, before LockBit’s March 10 claim. The affected organization therefore supplied both the first cyber-specific characterization and the disruption evidence.
The incident is presumed resolved. March 1 is the latest date on which credible public evidence showed operational impact was ongoing. The district has not published a restoration date or final all-clear, and the later LockBit claim does not establish that service disruption continued.
Confidence is high that the district experienced a cyber-related network disruption because its own notice described suspicious activity, affected systems and a network shutdown. Ransomware confidence is medium because a stable LockBit claim followed the district’s cyber disclosure, while actor confidence remains low because no independent evidence ties LockBit to the intrusion.
The public record does not establish when the underlying activity began, how access was obtained, which systems were affected, whether data was accessed or acquired, whether files were encrypted, the ransom amount, payment status or the date full service returned. The LockBit listing is preserved as a claim and does not by itself establish responsibility, access scope, data provenance or ransomware deployment.
LockBit listed “Alcorn Schools” March 10 and demanded an undisclosed ransom within two weeks. The district did not acknowledge the claim, and the listing does not establish LockBit responsibility, ransomware deployment, encryption, data theft or payment.
The district disabled its network districtwide. Biggersville contains Biggersville Attendance Center; the campus uses a Corinth mailing address but is physically in Biggersville.
The district disabled its network districtwide. Glen contains Alcorn Central Elementary, Middle and High schools.
The district disabled its network districtwide. Kossuth contains Kossuth Elementary, Middle and High schools; the campus uses a Corinth mailing address but is physically in Kossuth.
We reported that the district detected suspicious activity, disabled its network and warned that scheduled testing could be affected. The March 3 report relied on the district’s March 1 notice for the operational status.
The district said suspicious activity disrupted certain network systems and that it temporarily disabled its network while specialists investigated. It warned that scheduled testing could be affected.
Comparitech reported that LockBit listed “Alcorn Schools” March 10 and demanded an undisclosed ransom within two weeks. The district did not acknowledge the claim, and the report did not establish the access method, payment or data impact.
The district’s current directory lists nine schools and centers. Its linked campus pages place the Alcorn Central schools in Glen; the Kossuth schools in Kossuth; Biggersville Attendance Center in Biggersville; and district, career and alternative facilities in Corinth.
Signed-in members can report an error, update, or missing source.
