Skip to content
DysruptionHub
Sign in Subscribe

Harrison County Schools network disruption

Summary

Harrison County Schools logo

Harrison County Schools disabled its network after unauthorized access on Jan. 18, 2025. The district later said some current and former employees’ information was likely involved; student-data findings and the final restoration date remained unresolved.

Key facts

Timeline

  • Incident start:
    ? Earliest known or assessed start of malicious activity or incident activity.
  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted locations

Organization types

Critical infrastructure sector

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Presumed Resolved
Incident confidence:
High
Ransomware:
Low
Attribution:
Low

Attack mechanisms

Data impacts

  • Data unavailable

    Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.

Operational impacts

  • Network outage

    Internal or external network connectivity was unavailable or materially impaired.

  • Internal systems unavailable

    Internal business, administrative, operational, or staff-facing systems were unavailable.

  • Educational operations disrupted

    Instruction, student services, school administration, learning platforms, transportation, or other educational operations were materially affected.

Extortion indicators

  • Leak-site listing

    The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.

Incident narrative

Analyst assessment

Harrison County Schools in West Virginia experienced unauthorized access to computer systems on Jan. 18, 2025. The district’s Jan. 23 public notice said it disabled its network over the holiday weekend and brought in outside cybersecurity experts. A Feb. 14 update confirmed that the incident caused a temporary network outage throughout the district.

Operational significance

The shutdown interrupted the school system’s network and access to affected internal systems. Local reporting after a Jan. 24 emergency school board meeting described continuing work to restore operations and secure the network. The report said the state Department of Education, governor’s office and FBI had been notified and that state and outside investigators were assisting.

In February, the district said personal information belonging to some current and former employees was likely involved. It planned notification letters and credit monitoring and identity protection services. The same update said investigators had not yet determined whether student information was compromised. That ongoing data review does not establish that the network remained offline in February.

Confidence and uncertainty

Confidence in the cyberattack and network disruption is high because the district directly acknowledged unauthorized access and a districtwide outage. The available statements do not establish school closures, canceled classes, affected applications or an exact restoration date.

SafePay’s public tracker page at RansomLook includes the district’s domain, harcoboe.net. A Breachsense entry also attributes a claim to SafePay and lists 26 GB. These are tracker reports of an allegation, not independent confirmation that SafePay caused the outage, encrypted files or stole that amount of data. Their February listing dates differ and do not establish when the intrusion began.

Analytic gaps

The initial access method, any encryption, the final employee and student data findings, affected-person count and any ransom demand or payment remain unresolved. The last reviewed contemporaneous report of continuing operational recovery is dated Jan. 24. Operational status is presumed resolved based on elapsed time; no unsupported completion date is assigned.

Threat actor and claim

SafePay

Listed as: harcoboe.netSource: other

Claim details

Public ransomware trackers attribute a victim listing for harcoboe.net to SafePay. Breachsense lists 26 GB as the alleged dataset; RansomLook also indexes the domain under SafePay. These observations support a qualified claim, not independent confirmation of the responsible actor, encryption or the volume or contents of any stolen data. The district separately said some current and former employee information was likely involved, while student-data findings were unresolved. Tracker dates differ: RansomLook displays Feb.16,2025 and Breachsense labels discovery Feb.17; another tracker labels Feb.7. An exact original actor-post publication date is not established. Do not conflate this January2025 school-system incident with the separate2026 Harrison County Commission incident.

Organizations involved

Impacted locations

  • Clarksburg, West Virginia

    Clarksburg contains the affected school system’s central office at445WestMainStreet. The district’s temporary network shutdown establishes system-level disruption, while this municipal link supplies the physical administrative anchor; it does not imply a citywide outage or a verified classroom closure.

    Source

  • Harrison County, West Virginia

    The school district’s geographic remit is Harrison County. West Virginia Code18-1-3 defines a school district as all territory in one county;18-5-1 places it under a county board of education. Reuse the existing Harrison County boundary, independently verified as OSM relation1913124/admin6/FIPS54033. This service-area relationship locates the affected school system; it does not assert that every resident, county-government office or school facility suffered the same outage.

    Source

Sources

Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.