A June 2025 ransomware incident disrupted Lexington-Richland School District Five’s network, delayed retention bonuses and summer classes, and led to stolen files and released historical student records. The district attributes the attack to Interlock.
Malware that encrypts systems or data, typically accompanied by a ransom demand.
The use of deceptive messages or websites to trick people into revealing information, transferring funds or executing malicious content.
Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.
Stolen, exposed, or otherwise compromised data was publicly released, posted, distributed, or offered for download.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Internal or external network connectivity was unavailable or materially impaired.
The organization lost or materially restricted internet connectivity.
Internal business, administrative, operational, or staff-facing systems were unavailable.
The organization could not process, receive, issue, reconcile, or record payments normally.
Instruction, student services, school administration, learning platforms, transportation, or other educational operations were materially affected.
Services continued but with longer processing, response, delivery, or completion times.
The victim received a demand for payment in exchange for restoring access, decrypting systems, preventing disclosure, or stopping another threatened action.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
An authoritative source stated that no ransom or extortion payment was made.
Lexington-Richland School District Five experienced a June 2025 ransomware incident that disrupted its network, delayed employee retention bonuses and affected summer instruction. The district’s official incident information identifies June 3 as the date unusual activity made network devices unavailable and attributes the attack to Interlock. The South Carolina district serves communities in Lexington and Richland counties, including Irmo and Chapin. Our initial reporting documented the resulting disruption.
The district later confirmed that an unauthorized external individual took files. Its consumer notice dated Aug. 29 said potentially affected information included names, driver’s license or state identification numbers, financial account information, dates of birth and Social Security numbers. The categories varied among individuals. Separately, the official FAQ says historical student records from 2010 were released; that finding does not establish that every current student’s information was taken.
The network disruption affected administrative payments and education services. WIS reported June 5 that internet outages delayed retention bonuses scheduled for June 6. These payments were bonuses rather than ordinary salary checks. The State’s account of the August town hall also documented delays to high school summer classes. The evidence supports material disruption without establishing that all campuses closed or that all instruction stopped.
At a July 21 board meeting, district officials said full network operations had returned June 26. Deployment of additional security measures to more than 5,000 devices continued afterward. That continuing work and the later breach investigation do not establish a continuing operational outage. Network restoration supports a resolved operational assessment, while the precise bonus payment date and resumption date for every affected class remain unverified.
The superintendent said the district received a ransom demand and declined to pay, according to The State. The amount was not disclosed. The South Carolina regulator’s filing entry records 30,944 affected South Carolina residents. That figure describes the state’s reporting scope rather than the nationwide number of people affected. The district offered credit monitoring; its notice reported no known misuse as of Aug. 29, which does not negate the confirmed theft and release of records.
Confidence is high in the ransomware incident, operational disruption, file theft and the district’s attribution to Interlock because the district acknowledged them directly or through named reporting of its officials. The ransomware.live listing separately records a same-domain Interlock claim. The tracker’s discovery timestamp is not the intrusion date or a verified publication date for the original claim, and claimed data volumes remain unverified.
At the Aug. 26 town hall, the superintendent described investigators’ belief that phishing may have reached an employee. That account supports a qualified initial access assessment rather than a complete forensic reconstruction. The reviewed evidence does not identify a specific exploited vulnerability, establish a link to the separate PowerSchool incident or substantiate attribution to a foreign government.
The intrusion’s beginning before detection, detailed access sequence, exact volume of stolen information and full composition of the released files remain unresolved. Historical student records, information potentially affected in the notice and precautionary monitoring for current staff describe different evidence and populations. The exact date when every delayed payment and instructional activity returned to normal is also unverified; June 26 is the documented network restoration milestone. No single final date is assigned to all operational effects.
The district’s published public records responses say it withheld investigative records sought in October 2025, citing privilege and other exemptions, and directed readers to its incident FAQ. Those responses do not provide a public forensic reconstruction.
The district’s official FAQ attributes the June 3 ransomware incident to Interlock. This is affected-organization attribution rather than an independently reconstructed forensic finding. The FAQ’s original publication date is not displayed.
Tracker records an Interlock claim naming the district and matching lexrich5.org. Discovery date does not establish intrusion onset or original claim publication. Claimed data volume is unverified; the district independently confirms theft, historical record release and attribution.
Irmo contains the district’s administrative office at 1020 Dutch Fork Road. This identifies the affected organization’s base without asserting a townwide outage.
The district’s verified geographic remit. The network incident affected district operations; this relationship does not establish an outage at every campus or throughout the surrounding communities.
A cyberattack disrupted the district’s network and delayed employee retention bonus payments.
The district confirmed a data security incident and internet outages that delayed retention bonuses scheduled for June 6.
At a July 21 board meeting, the district reported that full network operations returned June 26 and that information had been taken.
The superintendent discussed the June incident at an Aug. 26 town hall and said investigators believed phishing may have reached an employee.
The superintendent said the district received and refused a ransom demand. High school summer classes and employee bonuses were delayed.
The district’s notice says an unauthorized external individual took files. Potential personal information included names, identification numbers, financial account information, dates of birth and Social Security numbers.
The regulator’s entry records the district’s breach notice on Sept. 3, 2025, with 30,944 affected South Carolina residents.
The district identifies the June 3 incident as ransomware attributed to Interlock and says historical student records were released.
The district’s published responses say investigative records requested in October 2025 were withheld and direct readers to its incident FAQ.
The tracker records an Interlock claim naming the district and matching its lexrich5.org domain.
Signed-in members can report an error, update, or missing source.
