Analyst assessment
A ransomware attack disrupted Goshen Central School District’s computer services, phones and email in July 2024. Superintendent Kurtis Kotes said the attack occurred late July 10, according to Mid-Hudson News’ July 11 report. The district contacted law enforcement and cybersecurity specialists. Cyber involvement and the district’s ransomware characterization are confirmed; the specific intrusion method and responsible operators remain unverified.
Operational significance
The district lost normal electronic communications and computer services. Schools and offices remained open for in-person meetings, and summer programs continued. The documented disruption concerns technology and administrative communications rather than a districtwide closure or cancellation of summer instruction.
A July 13 Daily Voice report quoted Kotes’ July 12 update that recovery specialists were still working on computer, telephone and email systems. Orange-Ulster BOCES was assisting. Temporary telephone numbers were hoped for by July 15; that expectation was not a completed restoration.
Confidence and uncertainty
The Highlands Current reported July 26 that the district was still addressing the attack as of July 18 and had established temporary telephone numbers. That is evidence of continuing response and alternate communications, not proof that the original systems were fully restored July 18 or July 26.
The incident is presumed resolved based on its historical age and the absence of later concrete operational impairment in the reviewed evidence. The exact restoration date remains unknown. The district reported the event began July 10, while the precise initial intrusion time remains unestablished.
A ransomware.live record identifies a later Fog claim naming the district and its gcsny.org domain, with a 10 GB allegation. The service recorded discovering that listing Oct. 23, 2024; that timestamp does not establish the actor’s original publication date or a new attack on that date. The listing does not independently confirm Fog caused the July disruption, that 10 GB was stolen, or that data was publicly released.
The 74’s February 2025 reporting said exposure of sensitive information remained unclear and school officials could not be reached. The reviewed evidence does not establish affected personal-data categories, a ransom amount, payment or a complete recovery date. The City of Newburgh’s separate June attack and its later data-impact statement are not findings about Goshen.
Analytic gaps
The reviewed evidence does not establish a verified initial access method, an exact end to all disruption, the actor’s original claim-post date or a forensic determination of data exposure. The district’s ransomware acknowledgment supports the attack classification, while the later Fog listing remains a separate allegation.
