Unauthorized network access disrupted Central Point School District 6’s phones, internet, email and student access to internal files in May 2025. Schools remained open, and nearly all systems were restored by June 6. Later district notices identified potentially affected personal files; Interlock’s responsibility remains an unverified claim.
Unauthorized access to systems, accounts, networks, or data.
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
A service, system, platform, or operational capability remained available only in part or with significant limitations.
Internal or external network connectivity was unavailable or materially impaired.
The organization lost or materially restricted internet connectivity.
Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
Internal business, administrative, operational, or staff-facing systems were unavailable.
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
Instruction, student services, school administration, learning platforms, transportation, or other educational operations were materially affected.
Services continued but with longer processing, response, delivery, or completion times.
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
Central Point School District 6’s May 2025 cyberattack disrupted communications and access to school systems while schools remained open. We reported that phones, internet and email were unavailable. The district’s May 14–15 notices confirmed unauthorized network access and isolation of affected systems. DysruptionHub assesses the cyberattack with high confidence. Interlock’s responsibility remains an attributed claim; the reviewed district statements do not confirm ransomware encryption.
Staff used cellular service and two-way radios as alternatives to unavailable communications. The district warned of delayed absence and bus-delay notifications, gradebook updates and responses to messages. Virtual individualized education program meetings were to be rescheduled. These restrictions affected school administration and student services without establishing a closure or suspension of classroom instruction.
A district restoration post contains updates dated May 20 and June 6. On May 20, phone service was 95% restored and internet, email, ParentVUE and Canvas were functioning, but students could not access data on internal servers. Documents in Google Drive remained accessible. The district restricted personal devices and prioritized loaner Chromebooks for seniors and students in credit recovery; grade entry could be delayed.
By June 6, the district said nearly all systems had been restored, including phones, internet, email and communications platforms. Oregon had also restored the district’s network link with state agencies. The operational incident is presumed resolved; this update does not establish the exact day every system returned.
The district’s Nov. 25 notice identified potentially affected files belonging to students, former students and former employees. Information could include names, birth dates, student identifiers and educational or employment information. It could not identify the complete affected population and reported no evidence of misuse. It said student information and financial systems were not involved; that finding does not negate the earlier communications and file-access restrictions.
Comparitech reported Interlock’s claim of 2.64 TB of stolen data. The claim matches the district’s name and domain, but the actor, volume and extent of theft remain unverified. Group tradecraft does not establish this incident’s initial access or encryption scope.
The earliest primary notices and contemporaneous local reporting establish May 14 activity. The June 6 update instead refers to a May 16 incident; the record uses the earlier documented date and preserves this inconsistency. The reviewed evidence does not establish the initial access method, ransom demand, payment outcome, complete affected population or exact final restoration day.
Interlock listed the district’s exact name and domain. Independent reporting described its allegation of 2.64 TB of stolen data, 2 million files and 360,000 directories. The district confirmed unauthorized network activity and potentially affected personal files but has not confirmed Interlock’s responsibility, the claimed volume or encryption scope. June 13 is the lead discovery date, not original publication or attack time.
The district-wide network and communications restrictions provide context for this service-area overlay. Schools remained open, and the overlay does not assert uniform disruption to every classroom or service.
Central Point anchors the district’s administrative operations and schools. This place relationship is distinct from the district-wide geographic service overlay.
Gold Hill contains district schools within the affected communications network. District-wide restrictions support this school-place association without establishing a separate intrusion or a closure at either school.
Signed-in members can report an error, update, or missing source.
