Unauthorized activity in Bellflower Unified School District’s network disrupted internet, phone, and on-premises services in August 2025 while staff rebuilt the environment. A later district breach notice said personal information may have been accessed, while Rhysida’s claim and alleged data publication remain unconfirmed attribution rather than official ransomware confirmation.
The organization publicly identifies the event as cyber-related. The organization publicly documents the resulting service disruption.
Unauthorized access to systems, accounts, networks, or data.
Threats to publish or sell stolen data without evidence of encryption.
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.
Data was made accessible to unauthorized parties through misconfiguration, system compromise, improper access controls, or another unintended condition.
Stolen, exposed, or otherwise compromised data was publicly released, posted, distributed, or offered for download.
A service, system, platform, or operational capability remained available only in part or with significant limitations.
Internal or external network connectivity was unavailable or materially impaired.
The organization lost or materially restricted internet connectivity.
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
Internal business, administrative, operational, or staff-facing systems were unavailable.
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
The actor published or released a substantial or complete set of allegedly stolen victim data.
DysruptionHub assesses with high confidence that Bellflower Unified School District experienced a malicious network intrusion that disrupted district technology services in August 2025. The district’s incident page says IT personnel discovered anomalous activity, secured and rebuilt the network, retained forensic specialists, and notified the FBI and Department of Homeland Security. A later district breach notice filed with the California Attorney General states that unauthorized activity occurred within district computer systems and that investigators determined personal information may have been accessed by an unauthorized third party.
The California breach repository identifies July 22, 2025, as the known breach date, while the first documented operational disruption began August 4. This indicates the malicious activity may have preceded the visible outage. The public record does not identify the initial access method, malware, encryption behavior, compromised account, or vulnerability.
Bellflower’s internet and phone services were unavailable across the district beginning August 4, and the district said many network services and on-premises servers were briefly inoperable. We reported that staff were directed to disconnect from wired ethernet, use a temporary guest network, and exercise caution with links and attachments while IT personnel and outside partners investigated. Phone service returned on August 5; by August 11, all sites had internet access and most functionality had been restored.
The disruption affected core communications and network access across a public school system, but the reviewed sources do not establish canceled classes, campus closures, interruption of instruction, or loss of cloud-hosted student systems. The district said cloud databases were not affected and that the outage was limited to on-premises servers.
The district identified the problem as a network security incident by August 5 and issued updates through October 30. Its early communications said sensitive student, parent, and employee data stored in externally hosted systems had not been affected, but the October update acknowledged an allegation that district data had been removed. The later breach notice narrowed that uncertainty by stating that personal information may have been accessed, although its template does not specify the affected data elements or number of people.
Rhysida listed Bellflower Unified on its leak site on October 28, according to DysruptionHub and ransomware tracking. DataBreaches.net later reported finding Bellflower employee tax and payroll material in files attributed to the group. DysruptionHub treats the listing and publication evidence as a threat-actor claim with corroborating possession evidence, not as confirmed responsibility for the intrusion or proof that ransomware encryption occurred.
The operational disruption is resolved. The district says it rectified the network issues, returned to full operation, rebuilt a secure environment, and implemented additional firewall, credential, and security-policy controls. The data-breach response continued into 2026, when the district notified potentially affected individuals and offered credit monitoring, but those later notification steps do not indicate renewed operational disruption.
Confidence is high that unauthorized activity caused the network disruption because the district directly confirmed both the anomalous activity and its response, and its later breach notice expressly describes unauthorized activity. Confidence is high that phone and internet access were disrupted and later restored.
Confidence is medium that district data was exfiltrated and published because the district acknowledged possible unauthorized access and a specialized breach-reporting outlet said it reviewed Bellflower files associated with the Rhysida publication. Rhysida attribution remains medium confidence rather than confirmed: the observed files support the group’s possession claim, but neither Bellflower nor law enforcement has attributed the intrusion to Rhysida. Ransomware remains low confidence because the district did not report encryption or a ransom demand.
The public record does not establish the initial access vector, compromised credentials, exploited vulnerability, malware family, encryption activity, dwell time, persistence, lateral movement, exact affected servers, complete data categories, number of affected people, full exfiltration volume, ransom demand, payment status, negotiation activity, restoration method, third-party role, or a law-enforcement attribution. The relationship between the July 22 breach date and the August 4 service disruption is not publicly explained.
Rhysida listed Bellflower Unified School District on its data-leak site on October 28, 2025. Later reporting said Bellflower employee tax and payroll files appeared in the published material, supporting possession of district data but not independently proving that Rhysida conducted the original intrusion or used encryption.
DysruptionHub reported that phone and internet outages began August 4, 2025, and that Bellflower Unified restored phones August 5 and internet access at all sites by August 11. It also documented the district’s data-removal allegation and an unconfirmed October 28 Rhysida leak-site claim.
DataBreaches.net reported that Bellflower Unified appeared on Rhysida’s leak site and that the group claimed 4.5 TB across more than 2.3 million files. The outlet said it reviewed portions of the released material and found Bellflower employee W-2 and other payroll or tax records.
Bellflower’s notice says the district became aware of unauthorized activity within its computer systems, secured the network, and engaged forensic investigators. On April 15, 2026, it determined that recipients’ personal information may have been accessed by an unauthorized third party and offered complimentary credit monitoring; California’s repository lists July 22, 2025, as the known breach date.
Bellflower Unified said District IT discovered anomalous network activity, remediated and rebuilt the environment, and restored full operations. A June 12 update said the investigation concluded, certain historical student, parent and employee information on an affected server could have been compromised, current Aeries data was not affected, notices and credit monitoring were provided, and no further anomalous activity was found.
Official geographic reference used with local and state material to verify place names, jurisdiction types and location context for bellflower, .
Signed-in members can report an error, update, or missing source.
