Skip to content
DysruptionHub
Sign in Subscribe

Jefferson Joint School District 251 ransomware disrupts instruction

Summary

Jefferson Joint School District 251 logo

Ransomware disrupted Jefferson Joint School District 251’s technology, phones and records access, prompting a Feb. 6, 2025, closure and canceled conferences. Recovery and device rebuilding were still underway in May; the final restoration date is unverified.

Key facts

Timeline

  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted location

Organization types

Critical infrastructure sector

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Presumed Resolved
Incident confidence:
High
Ransomware:
High

Attack mechanisms

  • Ransomware

    Malware that encrypts systems or data, typically accompanied by a ransom demand.

Data impacts

  • Data unavailable

    Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.

Operational impacts

  • Partial service outage

    A service, system, platform, or operational capability remained available only in part or with significant limitations.

  • Network outage

    Internal or external network connectivity was unavailable or materially impaired.

  • Internet access disruption

    The organization lost or materially restricted internet connectivity.

  • Phone service disruption

    Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.

  • Internal systems unavailable

    Internal business, administrative, operational, or staff-facing systems were unavailable.

  • Records access disruption

    Staff, customers, patients, students, residents, or other users could not access records or case information normally.

  • Educational operations disrupted

    Instruction, student services, school administration, learning platforms, transportation, or other educational operations were materially affected.

  • Facility closure

    One or more offices, schools, clinics, stores, plants, branches, or other facilities closed because of the incident.

  • Event or activity cancellation

    Scheduled events, meetings, hearings, classes, procedures, programs, or other activities were canceled.

  • Manual workaround required

    Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.

  • Alternate service channel required

    The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.

  • Staff unable to work normally

    Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.

Extortion indicators

  • Unknown extortion indicators

    The incident may involve extortion, but available evidence does not establish which extortion indicators were present.

Incident narrative

Analyst assessment

A ransomware attack disrupted Jefferson Joint School District 251’s computer network and classroom technology in early February 2025. Superintendent Chad Martin confirmed the incident and outside forensic assistance in KIFI’s Feb. 4 report. The district notified law enforcement and worked with specialists to investigate and recover its systems.

Operational significance

The district’s public notice said most classroom technology was unavailable. Schools closed Feb. 6 to give teachers time to adapt lessons, and parent-teacher conferences were canceled. Teachers with internet access outside school could use email; families were directed to school text lines when they could not reach staff.

In an East Idaho News interview, Martin said inaccessible records prevented useful parent conferences. The report identified effects at all 11 listed schools and phone outages at many campuses. Feb. 7 was already a scheduled day off. A planned return to normal school hours Feb. 10 did not establish that technology had been restored.

Recovery extended beyond the initial closure. Idaho Education News reported May 1 that Jefferson was still rebuilding damaged systems and reformatting nearly 5,000 student devices. The superintendent placed the attack in late January or early February. The prolonged work shows that reopening classrooms and restoring digital instruction were separate milestones.

Confidence and uncertainty

The district’s statement and superintendent interviews support high confidence in ransomware and material educational disruption. Martin told Idaho Education News that student data such as Social Security numbers had not been compromised. That attributed statement does not establish the disposition of every file or rule out all data theft.

The district’s separate PowerSchool vendor breach and American Falls School District’s March attack were distinct incidents. Reporting about those events does not establish Jefferson’s attacker, entry route, ransom terms or payment outcome.

Analytic gaps

The exact intrusion and detection dates, responsible group, full extent of any unauthorized data access and final restoration date remain unverified. Operational status is presumed resolved given the elapsed time since the May 1 recovery report, but a precise endpoint is not established.

Organizations involved

Impacted location

Sources

Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.