Ransomware disrupted Mecklenburg County Public Schools’ digital operations in Virginia in September 2025, requiring paper-based instruction while classes continued. The district later confirmed a return to normal operations, while reported Qilin claims and differing data-notification details require careful qualification.
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Internal or external network connectivity was unavailable or materially impaired.
Internal business, administrative, operational, or staff-facing systems were unavailable.
Instruction, student services, school administration, learning platforms, transportation, or other educational operations were materially affected.
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
The victim received a demand for payment in exchange for restoring access, decrypting systems, preventing disclosure, or stopping another threatened action.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
The actor published or shared a sample of allegedly stolen victim data to substantiate the extortion claim.
The actor threatened or carried out an increase in the payment demand, disclosure scope, or other consequences after a deadline or failed negotiation.
Mecklenburg County Public Schools in Virginia experienced a confirmed ransomware incident in September 2025. The division’s later notification letter says its technology team detected disruptions on or around Sept. 2 and quickly identified ransomware.
We reported the initial technology lockdown Sept. 3. The division took systems offline, brought in outside specialists and involved law enforcement.
Classes continued in person while teachers used whiteboards, paper and pencils in place of network-dependent tools, according to our initial account. Physical safety systems were reported to remain operational. This was an interruption of normal digital instruction, rather than evidence that campuses closed.
Subsequent reporting says internet systems returned about a week later. The district’s notification letter affirmatively states that systems were secured and operations returned to normal, but gives no exact recovery date.
Confidence is high in ransomware and material disruption because the district confirmed the mechanism and described the operational response. Comparitech reported a direct response from then-Superintendent Scott Worner identifying Qilin as the attacker. That supports high confidence in the reported attribution, while leaving the underlying forensic basis unavailable.
Qilin alleged 305 gigabytes of files and posted purported samples. The same reporting says Worner could not verify the affected data until the investigation was complete and described changing ransom demands. His conditional statement against payment at that time is not a final finding that no ransom was paid.
The district’s letter says names, contact details, birth dates and certain medical information might have been accessible. It also says there was no evidence of risk to Social Security numbers or financial identity. The Massachusetts regulatory entry flags additional categories, including Social Security and driver’s license information. Those differing descriptions remain unresolved; neither establishes the full scope of the actor’s claimed theft.
The entry method, complete compromised-record inventory, total affected population, final payment decision and recovery cost remain unestablished. Four affected Massachusetts residents in the regulatory entry is a state-specific count. Claim descriptions that name Charlotte-Mecklenburg in North Carolina conflict with the verified Virginia victim and should not redefine this incident’s identity.
Operations are resolved based on the district’s affirmative restoration statement. The last precisely dated initial impact observation reviewed is Sept. 3, 2025; later reporting gives only an approximate week-long internet recovery. The exact end date remains unset. The undated notification and later claim coverage do not extend the outage timeline.
Qilin listed Mecklenburg County Public Schools and alleged305GB with sampledocuments. MCPleadwebsiteww.mcpsweb.org points toVirginia butdescriptionmisnamesCharlotte-MecklenburgNC; do notcopythatidentity. Comparitech’s directsuperintendentresponse independently linksQilin toVirginiaSept.2025incident. Preciseoriginalclaimpostingtime andclaimedfileauthenticity/volumenotverified; discoverytime retained separately.
Preserves Boydton as the division’s central-office municipality anchor. The larger countywide school service area is separately represented; town government is not an affected organization.
Full Census district5102460 and county51117 polygons have identical3614undirectedboundaryedges and landarea1619544357m². Reuses existing county boundary for the affected school division’s coextensive service area; does not imply county-government compromise or every resident affected.
Our initial report documented technology lockdown, continued in-person classes and paper/whiteboard instruction.
Entry2025-1929 lists Nov.14,2025 filing andfour Massachusettsresidents, withSSN/medical/driverslicense flags.
The district confirms ransomware detected on or around Sept.2,2025 and says operations returned to normal; personal information might have been accessible.
The superintendent confirmed Qilin as the attacker and described changing demands, while the claimed files remained unverified; internet returned about a week later.
Signed-in members can report an error, update, or missing source.
