Analyst assessment
A network outage publicly reported Feb. 23, 2025, forced Aztec Municipal School District in northwestern New Mexico to close campuses beginning Feb. 24. The district’s original notice said the outage prevented safe operations. Schools reopened March 3, according to subsequent reporting, but reopening did not mark full network recovery.
Comparitech reported March 21 that Interlock had claimed responsibility and alleged theft of 1.3 terabytes of financial, tax, employee and student information. That stable claim and external reporting support a confirmed cyber assessment. The district had not verified the attribution or alleged theft; ransomware deployment and encryption remain unverified.
Operational significance
The outage interrupted classroom instruction and access to network-dependent safety and communication systems. Local reporting described unavailable email and online tools, paper learning packets, meal pickup and canceled parent-teacher conferences. Athletics continued. KOB reported that outside IT specialists were restoring systems supporting doors, cameras and access to student contact information.
In its March 4 update, the district described temporary measures to secure doors after loss of network connectivity. Network restoration continued, and non-school devices were barred from connecting. These measures document continuing recovery after students returned.
Confidence and uncertainty
Confidence is high in the closures and operational disruption. Interlock’s responsibility and alleged data theft carry lower confidence because the reviewed evidence does not independently authenticate the group’s allegations. Comparitech reported a leak-site listing and images presented as stolen documents; those observations establish an extortion indicator, not verified theft volume or affected individuals.
A district spokesperson told local reporters during the initial investigation that there was no evidence sensitive or personal information had been compromised. That preliminary finding is not a final determination that no information was affected. No verified ransom demand, payment, entry vector or attacker encryption was established.
Analytic gaps
The precise intrusion date, full forensic findings, final privacy determination and date of complete technical restoration remain unverified. Feb. 23 is the earliest verified public outage notice, and March 4 is the latest directly dated district update documenting continuing recovery. The incident is assessed as presumed resolved, with no exact end date. The original draft’s Feb. 22 start and March 18 end lacked support and have been removed.
