Belhaven University
Belhaven University cyber incident
Summary
Belhaven University took portions of its internal network offline March 6 after identifying a cybersecurity incident. Some services remained unavailable March 18; most student services were operating normally and online classes were scheduled to resume March 19. No final all-clear was published, supporting presumed-resolved rather than resolved status.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted location
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
DD-CIT assessment
The organization publicly identifies the event as cyber-related. The organization publicly documents the resulting service disruption.
Attack mechanisms
-
Unknown cyber mechanism
The incident is confirmed to be cyber-related, but the specific attack mechanism is unknown.
Data impacts
-
Unknown data impact
The incident is cyber-related, but available evidence does not establish whether or how data was affected.
Operational impacts
-
Partial service outage
A service, system, platform, or operational capability remained available only in part or with significant limitations.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
We reported that Belhaven University suspended access to portions of its internal network March 6, 2026, after identifying a cybersecurity incident. The university engaged cybersecurity specialists and law enforcement while it investigated and restored systems. Belhaven’s direct statement provides concrete cyber evidence, but the public record does not identify the mechanism or a responsible actor.
Operational significance
Belhaven said some services remained temporarily unavailable March 18 while systems were reviewed before returning to operation. WLBT reported that most student services were operating normally and online classes would resume March 19. SuperTalk Mississippi described campus operations as largely normal and said full restoration was expected by the end of the week.
The documented physical location is Belhaven’s main campus in Jackson, Mississippi. Online-course disruption was also documented, but the evidence does not identify another affected physical campus or organization.
Disclosure posture
Belhaven’s March 18 statement directly identified a cybersecurity incident and described the resulting network suspension and service unavailability. No earlier external cyber characterization or stable victim claim was identified, supporting organization-confirmed cyber and organization-documented disruption.
Current status
Restoration was well advanced March 18, but some services remained unavailable, online classes had not yet resumed and full restoration was described as an expectation rather than a completed fact. No later final all-clear was found. The incident is therefore presumed resolved rather than resolved on a documented date.
Confidence and uncertainty
Confidence is high that Belhaven deliberately took network portions offline in response to a cyber incident. Belhaven said it had no evidence personal information was compromised at that stage, but the investigation was still underway; the final data impact remains unknown.
No stable ransomware or extortion victim claim was identified for Belhaven University or belhaven.edu. The public record does not establish ransomware, a ransom demand, negotiations, a payment deadline or payment.
Analytic gaps
The public record does not establish the initial access vector, affected applications, malware, actor, persistence, lateral movement, data-access scope, final forensic conclusion, complete restoration date, recovery cost or notification obligations.
Organizations involved
Impacted location
Sources
Belhaven detected a cybersecurity incident March 6, took portions of its internal network offline and reported some services still unavailable March 18.
Belhaven President Roger Parrott said the university suspended access to portions of its internal network March 6 after identifying a cybersecurity incident. Some services remained unavailable March 18, most student services were operating normally and online classes were scheduled to resume March 19.
Belhaven said systems had been reviewed and restored and campus operations were largely normal March 18. Online classes were scheduled to resume March 19, and full restoration was expected by the end of the week; the report did not announce a completed full restoration.
The organization’s official website describes its identity, services, operating role and public or customer-facing programs.
The Census Bureau Gazetteer Files provide authoritative geographic reference data for states, counties, county equivalents and places in the United States.
See something that needs correction?
Signed-in members can report an error, update, or missing source.