Skip to content
DysruptionHub
Sign in Subscribe

Jackson County Public Schools DDoS Attack

Summary

Jackson County Public Schools logo

A reflection distributed denial-of-service attack began Nov. 22, 2025, against Jackson County Public Schools in North Carolina. The district closed all schools Nov. 25 when network repairs took phones, internet and campus safety systems offline; it reported normal network function that evening.

Key facts

Timeline

  • Incident start:
    ? Earliest known or assessed start of malicious activity or incident activity.
  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
  • Incident end:
    ? Confirmed or defensibly assessed end of material operational disruption or incident activity.

Primary victim organization

Impacted locations

Organization types

Critical infrastructure sector

DysruptionHub coverage

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Resolved
Incident confidence:
High

Attack mechanisms

Data impacts

  • No known data impact

    Available evidence indicates that the incident did not materially affect the confidentiality, integrity, or availability of data.

Operational impacts

  • Network outage

    Internal or external network connectivity was unavailable or materially impaired.

  • Internet access disruption

    The organization lost or materially restricted internet connectivity.

  • Phone service disruption

    Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.

  • Internal systems unavailable

    Internal business, administrative, operational, or staff-facing systems were unavailable.

  • Educational operations disrupted

    Instruction, student services, school administration, learning platforms, transportation, or other educational operations were materially affected.

  • Facility closure

    One or more offices, schools, clinics, stores, plants, branches, or other facilities closed because of the incident.

Extortion indicators

  • No known extortion indicator

    Available evidence indicates that no extortion demand, threat, communication, or related pressure tactic was identified.

Incident narrative

Analyst assessment

Our Nov. 26 report documented Jackson County Public Schools’ disclosure that a reflection DDoS attack overwhelmed its firewall. The district said its defenses blocked internal access and found no evidence that staff or student data was compromised. The attack and operational disruption are confirmed; the operators’ identity is unknown.

Operational significance

Traffic that began Nov. 22 crippled district connectivity. Schools opened Monday with cameras and door controls still operating, then closed Tuesday, Nov. 25, when repair work required a full network shutdown. Internet, Wi-Fi, phones, internal systems and safety communication tools were unavailable across schools, preventing reliable emergency and family communications. The district’s official school directory locates facilities in Sylva, Cullowhee, Cashiers and Whittier. The district’s service area is distinct from Jackson County because the Qualla Boundary is served by a different school system.

Current status

The district said late Nov. 25 that the network was functioning normally and no JCPS data was compromised. Students were already scheduled to be off Wednesday through Friday for Thanksgiving, with return planned Dec. 1. The reported technical disruption was resolved.

Confidence and uncertainty

Confidence is high in the DDoS mechanism and closure because district officials described both. The source IP countries reported by district staff do not establish the attackers’ location or identity; motive and any broader campaign remain unverified.

Organizations involved

Impacted locations

Sources

Jackson County Public Schools directions
Jackson County Public SchoolsRetrieved:
  • Type: Official Statement
  • Stance: Report
  • Platform: Website
  • Medium: Web Page
  • Confidence: High

The district lists its central office in Sylva and schools in Sylva, Cullowhee, Cashiers and Whittier.

Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.