Analyst assessment
Bertie County Schools announced April 9, 2025, that its phones and internet were out. Qilin subsequently appeared in external reporting as claiming the district, and a ransomware.live entry identifies its exact official domain, bertie.k12.nc.us, as a Qilin-listed victim. The documented outage and stable, victim-specific claim support inclusion as a cyber incident with medium overall confidence. They do not independently establish that Qilin caused the outage or that ransomware encrypted district systems.
Operational significance
The district’s original notice consists of an outage graphic and a promise to provide updates. It confirms unavailable phone and internet services but gives no start time, affected-school count, alternative contact arrangement or restoration date. These failures affected two basic communication services used by the school system. The reviewed primary evidence does not establish canceled classes, missed testing, transportation failures or closure of any campus.
The affected organization is the countywide public school district in northeastern North Carolina. Its service area coincides with Bertie County in the Census boundary data. Windsor is also a physical place anchor because the district operates Windsor Elementary School within the town; that relationship does not establish a townwide outage or a separately confirmed failure at that campus.
Confidence and uncertainty
An April 18 external report described the Qilin claim and connected it to the April 9 outage notice. The tracker’s April 17 discovery timestamp records when the listing was found, not when it was published or when an intrusion began. The original claim publication date remains unknown. The district notice does not use cyber- or security-specific language, and no later district cyber acknowledgment was found in the bounded official-site and public-source checks.
Our April 26 Ghost article reported an approximate April 8 onset, an April 18 listing and a 50-gigabyte theft allegation. The original outage post establishes service unavailability on April 9, but does not verify an April 8 onset. The tracker discovery predates the article’s stated listing date; neither date is treated as a verified original publication date. The theft volume, encryption, ransom demand and Qilin’s responsibility remain unverified allegations.
Analytic gaps
No reviewed primary source establishes the entry route, compromised accounts, encryption, categories of affected information, payment outcome, costs or a complete recovery date. The historical operational status is presumed resolved because the only independently verified contemporaneous outage observation is from April 2025; this is not a documented restoration milestone. The end date remains unset. Later unrelated education-technology breaches and other North Carolina incidents are not evidence about this event.