Flemington-Raritan Regional School District cyber incident

Analyst assessment

Flemington-Raritan Regional School District experienced a cyber incident beginning May 6, 2025, that disrupted computer-based operations and prompted the district to take systems offline. In a May 7 video message, Superintendent Kari McGann said the district was securing its systems and investigating with the New Jersey Cybersecurity and Communications Integration Cell. The direct acknowledgment and concrete operational changes support a confirmed cyber assessment with high confidence.

We reported May 9 that digital-service recovery remained underway. The district’s May 22 board minutes subsequently described some service disruption while emphasizing that classroom instruction continued. These records establish an interruption to educational operations, without establishing a districtwide school closure.

Operational significance

McGann announced that science testing scheduled for May 8 in grades five and eight would be paused and rescheduled with the New Jersey Department of Education. Students were told to keep devices turned off and stowed during school, and teachers were asked to minimize internet use to reduce traffic to online platforms. Students could continue using devices at home; the superintendent distinguished the district’s systems from families’ home environments.

The combination of offline systems, postponed testing and restrictions on classroom technology changed how students and staff could work even as instruction continued. The district serves Flemington Borough and Raritan Township in Hunterdon County. That service territory provides geographic context for the affected school system; it does not establish an outage at every school or every location in either municipality.

Confidence and uncertainty

The district said May 7 that it did not believe personal information had been compromised, and the May 22 minutes reported no compromise of personally identifiable information while the investigation continued. Those statements describe the district’s findings at those times; they do not identify the intruders, initial access method or full technical scope.

Comparitech’s May roundup classified the district among ransomware incidents but supplied no case-specific evidence of encryption, a ransom demand or a named attacker. The reviewed district statements did not identify ransomware. Ransomware involvement and attribution therefore remain unresolved, and no matching public extortion claim was found in the name, domain and alias searches.

Analytic gaps

The reviewed evidence does not establish an exact final restoration date, the systems affected in detail, an initial access route or any ransom payment. The operational status is presumed resolved because the contemporaneous disruption is historical and no continuing operational impact was established in the follow-up review. This is not a claim of verified full restoration, and no exact end date is assigned. Later board records and current school activity do not by themselves identify when every affected system returned.