Skip to content
DysruptionHub
Sign in Subscribe

Aurora Public Schools network and phone outage

Summary

Aurora Public Schools logo

Aurora Public Schools shut down its network after suspicious activity Jan. 13, 2025, disrupting internet, phones and school schedules. Core services returned, but some applications and building connections still needed work Jan. 23.

Key facts

Timeline

  • Incident start:
    ? Earliest known or assessed start of malicious activity or incident activity.
  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted locations

Organization types

Critical infrastructure sector

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Presumed Resolved
Incident confidence:
High
Ransomware:
Low
Attribution:
Low

Attack mechanisms

  • Unknown cyber mechanism

    The incident is confirmed to be cyber-related, but the specific attack mechanism is unknown.

Data impacts

  • Unknown data impact

    The incident is cyber-related, but available evidence does not establish whether or how data was affected.

Operational impacts

  • Partial service outage

    A service, system, platform, or operational capability remained available only in part or with significant limitations.

  • Network outage

    Internal or external network connectivity was unavailable or materially impaired.

  • Internet access disruption

    The organization lost or materially restricted internet connectivity.

  • Phone service disruption

    Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.

  • Internal systems unavailable

    Internal business, administrative, operational, or staff-facing systems were unavailable.

  • Application unavailable

    A specific application or software platform became unavailable or unusable.

  • Educational operations disrupted

    Instruction, student services, school administration, learning platforms, transportation, or other educational operations were materially affected.

  • Delayed opening or early closure

    The organization delayed opening, closed early, or reduced operating hours because of the incident.

  • Event or activity cancellation

    Scheduled events, meetings, hearings, classes, procedures, programs, or other activities were canceled.

  • Manual workaround required

    Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.

  • Staff unable to work normally

    Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.

Extortion indicators

  • Leak-site listing

    The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.

Incident narrative

Analyst assessment

Aurora Public Schools shut down its network after staff detected suspicious activity early Jan. 13, 2025, interrupting internet and phone service across the Colorado district. In an email reported by 9NEWS on Jan. 14, spokesperson Corey Christiansen described precautionary steps to protect the district’s systems and work with outside experts. His qualified account establishes a cyber-related security concern without identifying the entry method or confirming ransomware.

Operational significance

The disruption affected campuses and district offices while classes initially continued. The district then announced two-hour delayed starts for Jan. 16 and 17 and canceled morning preschool Jan. 16. Friday preschool was not scheduled, and the Jan. 20 closure was the Martin Luther King Jr. holiday.

Intercom systems remained operational, staff could receive family calls and emails through available arrangements, and schools used printed emergency contact information. These measures supported communication while normal network services were unavailable.

By Jan. 23, internet and phone service had returned, but Christiansen said some buildings could still have connectivity problems and some programs remained unresponsive. In a Jan. 30 superintendent’s update, the district said internet, phones, security cameras and most other services had been restored.

Confidence and uncertainty

Confidence in the documented shutdown and operational effects is high. The district’s acknowledgment of suspicious network activity supplies concrete cyber-specific evidence, although the reviewed statements leave the technical cause unresolved.

A ransomware tracker listing attributes a claim involving aurorak12.org to Fog and records an allegation of 171 GB. The listing does not independently confirm the responsible group, encryption, data theft or the contents of any alleged dataset. Its February discovery date is not the attack date or a verified original publication time.

Analytic gaps

The initial access method, any confirmed compromise of student or employee information, ransom demand or payment and final technical restoration date remain unresolved. The district’s Jan. 21 restoration goal was prospective, and its later statement that most services were restored does not establish an exact all-clear. Operational status is presumed resolved, with Jan. 23 as the latest precisely dated evidence of remaining service problems and no unsupported end date assigned.

Threat actor and claim

fog

Listed as: Aurora Public Schools (aurorak12.org)Source: ransomware.liveDiscovered:

Claim details

Ransomware.live indexes an alleged Fog victim listing for Aurora Public Schools and aurorak12.org, with an alleged 171 GB dataset. The tracker records discovery on Feb. 11, 2025, at 16:24:23.202750 UTC; that observation is neither a verified original actor-post publication time nor the attack date. No original actor post URL or supported attack date was supplied. The district independently acknowledged suspicious network activity and a precautionary shutdown in January, but the reviewed official statements do not confirm Fog attribution, encryption, theft, the contents or volume of any dataset, or a ransom demand or payment. Preserve this as a qualified external allegation with low actor and ransomware confidence. Reuse the existing Fog actor and claim; the same actor is already used for the separately reviewed Williamsburg-James City County schools allegation.

Organizations involved

Impacted locations

  • Adams-Arapahoe Joint School District 28-J, Colorado

    Geographic remit of the affected Aurora Public Schools/Adams-Arapahoe28J, paired with the organization service_area. District statements establish network/phone disruption at campuses and offices; this overlay does not assert a municipal or countywide outage or identical impact at every site.

    Source

  • Aurora, Colorado

    Aurora contains the district’s verified central-office site and affected schools. Districtwide network and phone disruption was acknowledged by the district. This supported site-level city link does not assert a citywide outage or identify the intrusion’s point of origin.

    Source

Sources

Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.