Appomattox County school and government ransomware attack

Analyst assessment

Ransomware disrupted Appomattox County Public Schools and shared county government technology in Virginia in February 2025. In its official cybersecurity notice, the school division said it became aware of disruptions on or about Feb. 17 and identified a ransomware incident. It explained that it hosted network infrastructure for Appomattox County government, which extended the effects to other public services.

The division and county engaged outside cybersecurity specialists and notified state and federal authorities. The notice identifies cooperation with the FBI and Virginia State Police. Public cyber acknowledgment is documented in WFXR’s Feb. 17 report, which quotes county officials. The initial intrusion date, technical access method and perpetrator have not been established.

Operational significance

The school division closed schools Feb. 18 as a precaution while specialists examined its environment. The remainder of that week’s closures were caused by winter weather, rather than a documented decision to keep schools closed for the cyber incident. The Feb. 18 school update announced a weather closure for Feb. 19 while reporting that internet service remained down. A Feb. 19 update again described an internet outage during preparations for the next day’s weather closure.

County officials said essential services and 911 remained operational. WDBJ’s Feb. 21 reporting also reported functioning county public and safety services, as well as working school security cameras, doors and phone systems. A scheduled reopening of county offices and the courthouse is not treated as proof that they had closed because of the attack.

Schools announced a Feb. 24 return to class. The later school notice describes continuing technology limitations after students returned, so reopening does not establish complete IT restoration. Presumed resolved status reflects the return to instruction and the historical recovery record, while the exact end date remains unknown.

Confidence and uncertainty

Confidence is high in the ransomware classification and disruption to the shared environment because the school division directly identified both. No reviewed claim establishes a specific ransomware operator. The school division said its cloud-based student information and human resources systems were not involved; the latter handled payroll and benefits. These statements do not establish the security of every other system.

The notice says the scope of potentially affected information could not be determined quickly and lists categories of information the division held. That inventory is not proof that every category was accessed or stolen. It also says credit-monitoring enrollment information was mailed to current students and employees. The reviewed evidence does not establish a verified exfiltration total or affected-person count.

Analytic gaps

A precise full-restoration date, forensic access findings, incident-specific costs and any ransom demand or payment remain unverified. The school website lists its cybersecurity document as first published Feb. 27, 2025, and updated Dec. 2, 2025; the current PDF is undated. Statements in that version are not all attributed to the original February publication. Weather closures, classroom reopening and restoration of every technology service remain separate milestones.