Skip to content

Bertie County Schools cyber incident

Summary

Bertie County Schools logo

Bertie County Schools announced phone and internet outages April 9, 2025. A stable external listing names the district’s official domain as a Qilin victim. The district did not identify a cyber cause in its notice, and the reviewed evidence does not verify ransomware, data theft, the claim’s causal connection to the outage or a restoration date.

Key facts

Timeline

  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Organization types

Critical infrastructure sector

Incident characteristics

Assessments

Attack mechanisms

  • Unknown cyber mechanism

    The incident is confirmed to be cyber-related, but the specific attack mechanism is unknown.

Data impacts

  • Unknown data impact

    The incident is cyber-related, but available evidence does not establish whether or how data was affected.

Operational impacts

Extortion indicators

  • Leak-site listing

    The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.

Incident narrative

Analyst assessment

Bertie County Schools announced April 9, 2025, that its phones and internet were out. Qilin subsequently appeared in external reporting as claiming the district, and a ransomware.live entry identifies its exact official domain, bertie.k12.nc.us, as a Qilin-listed victim. The documented outage and stable, victim-specific claim support inclusion as a cyber incident with medium overall confidence. They do not independently establish that Qilin caused the outage or that ransomware encrypted district systems.

Operational significance

The district’s original notice consists of an outage graphic and a promise to provide updates. It confirms unavailable phone and internet services but gives no start time, affected-school count, alternative contact arrangement or restoration date. These failures affected two basic communication services used by the school system. The reviewed primary evidence does not establish canceled classes, missed testing, transportation failures or closure of any campus.

The affected organization is the countywide public school district in northeastern North Carolina. Its service area coincides with Bertie County in the Census boundary data. Windsor is also a physical place anchor because the district operates Windsor Elementary School within the town; that relationship does not establish a townwide outage or a separately confirmed failure at that campus.

Confidence and uncertainty

An April 18 external report described the Qilin claim and connected it to the April 9 outage notice. The tracker’s April 17 discovery timestamp records when the listing was found, not when it was published or when an intrusion began. The original claim publication date remains unknown. The district notice does not use cyber- or security-specific language, and no later district cyber acknowledgment was found in the bounded official-site and public-source checks.

Our April 26 Ghost article reported an approximate April 8 onset, an April 18 listing and a 50-gigabyte theft allegation. The original outage post establishes service unavailability on April 9, but does not verify an April 8 onset. The tracker discovery predates the article’s stated listing date; neither date is treated as a verified original publication date. The theft volume, encryption, ransom demand and Qilin’s responsibility remain unverified allegations.

Analytic gaps

No reviewed primary source establishes the entry route, compromised accounts, encryption, categories of affected information, payment outcome, costs or a complete recovery date. The historical operational status is presumed resolved because the only independently verified contemporaneous outage observation is from April 2025; this is not a documented restoration milestone. The end date remains unset. Later unrelated education-technology breaches and other North Carolina incidents are not evidence about this event.

Threat actor and claim

Listed as: bertie.k12.nc.usSource: ransomware.live

Claim details

A stable tracker entry identifies Qilin and the district’s exact official domain bertie.k12.nc.us. The lead was discovered April 17, 2025 at 09:18:14 UTC; original publication and attack dates are unknown. The district’s April 9 outage notice does not identify a cyber cause. This is a low-confidence attribution claim, not confirmation of responsibility, ransomware, data theft or causal connection to the documented phone/internet outage.

Organizations involved

Impacted locations

  • Bertie County, North Carolina

    The affected school district’s Census 3700360 polygon exactly equals Bertie County 37015, with zero symmetric difference. Reuse county as district geographic remit; no countywide outage is asserted.

    The district central administrative complex at 715 US Highway 13 North is in Bertie County. Address geocoding is ambiguous within the county; no precise municipal containment is asserted for that office.

  • Windsor, North Carolina

    District physical-place anchor: official Windsor Elementary School address 104 Cooper Hill Road matches Census Windsor town 3774680 and Bertie County 37015. No separate campus-specific or townwide outage is asserted.

Sources

We will keep you updated: phones and internet are out

The district’s graphic states that its phones and internet are out; the caption promises updates.

Qilin victim listing: bertie.k12.nc.us

The tracker records Qilin listing bertie.k12.nc.us, with website www.bertie.k12.nc.us and country US.

See something that needs correction?

Signed-in members can report an error, update, or missing source.