Skip to content
DysruptionHub
Sign in Subscribe

Rutherford County Schools breach disrupts network access

Summary

Rutherford County Schools logo

A November 2024 breach disrupted Rutherford County Schools’ network, internet access and testing. Later disclosures confirmed unauthorized acquisition and release of employee and student information.

Key facts

Timeline

  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted location

Organization types

Critical infrastructure sector

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Resolved
Incident confidence:
High
Ransomware:
Unresolved
Attribution:
Unresolved

Attack mechanisms

Data impacts

  • Data theft or exfiltration

    Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.

  • Data publication or leak

    Stolen, exposed, or otherwise compromised data was publicly released, posted, distributed, or offered for download.

Operational impacts

  • Partial service outage

    A service, system, platform, or operational capability remained available only in part or with significant limitations.

  • Network outage

    Internal or external network connectivity was unavailable or materially impaired.

  • Internet access disruption

    The organization lost or materially restricted internet connectivity.

  • Educational operations disrupted

    Instruction, student services, school administration, learning platforms, transportation, or other educational operations were materially affected.

  • Service delay

    Services continued but with longer processing, response, delivery, or completion times.

Extortion indicators

  • Ransom demand

    The victim received a demand for payment in exchange for restoring access, decrypting systems, preventing disclosure, or stopping another threatened action.

  • Leak-site listing

    The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.

  • Data sample published

    The actor published or shared a sample of allegedly stolen victim data to substantiate the extortion claim.

  • Countdown or payment deadline

    The actor imposed a deadline or public countdown before increasing the demand, publishing data, deleting keys, or taking another threatened action.

Incident narrative

What happened

Rutherford County Schools in Tennessee reported a network and systems disruption beginning Nov. 25, 2024. The incident interrupted access to school technology and led to an investigation involving outside specialists and the Tennessee Bureau of Investigation.

Effects on schools

Internet access remained offline Dec. 6, NewsChannel 5 reported. Students were instructed to leave laptops at school. WKRN reported delayed end-of-course exams and extra time for assignments.

By Dec. 11, the district said backup and recovery procedures had restored most services. Some systems still had not returned to full functionality, although schools remained open and operating.

Information obtained and extortion claim

The district initially said its investigation had not found that student personal information was obtained. Director Jimmy Sullivan confirmed Dec. 30 that some employee and student information had been acquired without authorization. The district said it was reviewing the affected data and would notify individuals as required by law.

WKRN reported that a Rhysida-branded site offered purported school data for 20 bitcoin in a seven-day auction and displayed sample documents. That claim does not independently establish the attacker’s identity or prove that school files were encrypted.

Recovery and later disclosure

In a July 15, 2025, official statement, Rutherford County confirmed that the incident affected school servers and resulted in the unauthorized release of employee and student personal information. It said essential network services had been restored within a week and reported no material impact on county operations or finances.

The later account describes essential services; contemporary reporting documented continuing limitations in December. The reviewed sources do not establish an exact date when every affected system was restored.

Threat actors and claims

Rhysida

Listed as: Rutherford County SchoolsSource: ransomware.liveDiscovered:

Claim details

Rhysida claimed Rutherford County Schools in a listing observed Dec. 11, 2024. WKRN independently reported a Rhysida-branded auction offering purported district files for 20 bitcoin, displaying samples and a seven-day deadline. These are reported extortion claims, not independent proof of operator identity, encryption, payment or every claimed file. The district and later county disclosure separately confirm unauthorized acquisition and release of employee and student information. The tracker observation timestamp is not the original post publication time.

blacksuit

Listed as: rcschools.netSource: ransomware.liveDiscovered:

Claim details

A BlackSuit listing for rcschools.net was observed by ransomware.live Oct. 19, 2024, before the school disruption beginning Nov. 25. The tracker gives no attack date. This earlier allegation is retained for investigation; reviewed evidence does not establish that it concerns the same intrusion or identifies the operator responsible for the November disruption. The original Ghost article’s BlackSuit suggestion is not independent attribution evidence.

Organizations involved

Impacted location

  • Murfreesboro, Tennessee

    Murfreesboro contains the school district’s central office at 2240 Southpark Drive. It provides a physical anchor for the affected district. The incident does not establish disruption to the separate Murfreesboro City Schools system. A district service-area relationship remains a separate geographic follow-up.

Sources

Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.