Claim details
WorldLeaks listed San Felipe Del Rio CISD School and the sfdr-cisd.org domain on March 31, 2026. The listing is treated as a claim and does not independently prove ransomware deployment, data theft or WorldLeaks responsibility.
San Felipe-Del Rio CISD cyber incident
Summary
San Felipe-Del Rio CISD detected suspicious email activity March 18 before internet, phones and other in-network communications and data systems went down. Schools, classes and transportation continued. WorldLeaks later listed the district, but the claim does not prove ransomware, data theft or actor responsibility; the incident is presumed resolved.
Key facts
Timeline
-
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
Incident characteristics
Assessments
DD-CIT assessment
The organization publicly identifies the event as cyber-related. The organization publicly documents the resulting service disruption.
Attack mechanisms
-
Unknown cyber mechanism
The incident is confirmed to be cyber-related, but the specific attack mechanism is unknown.
Data impacts
-
Unknown data impact
The incident is cyber-related, but available evidence does not establish whether or how data was affected.
Operational impacts
-
Network outage
Internal or external network connectivity was unavailable or materially impaired.
-
Internet access disruption
The organization lost or materially restricted internet connectivity.
-
Phone service disruption
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Educational operations disrupted
Instruction, student services, school administration, learning platforms, transportation, or other educational operations were materially affected.
Extortion indicators
-
Leak-site listing
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
Incident narrative
Analyst assessment
We reported that San Felipe-Del Rio CISD detected suspicious email activity March 18 before internet, phones and other in-network communications and data systems went down. The district’s cyber-specific wording and security-monitoring response support a confirmed cyber assessment.
WorldLeaks listed the district’s sfdr-cisd.org domain March 31. The listing is stable external cyber and extortion evidence because it identifies the claimant and victim, but it does not prove actor responsibility, ransomware deployment, data theft or any alleged technical method.
Operational significance
Telephone service returned quickly, while technology teams continued restoring internal communications, internet and data systems. Schools, classes and transportation remained in normal operation, and the district did not report a closure or cancellation.
The district’s March 19 update is the last public evidence of continuing operational impact. No later source documented an ongoing disruption, so the incident is presumed resolved without assigning an unsupported restoration date.
Geographic scope
The affected service area is San Felipe-Del Rio CISD in Val Verde County, Texas. The current official directory identifies 16 school and alternative campuses, a Career and Technical Education site, and the Student Performance Center and Administration Building. The Roberto “Bobby” Barrera Elementary STEM Magnet School is physically on Laughlin Air Force Base; the other verified sites are in Del Rio.
Garfield is represented once at 300 W. Martin St. The current primary school directory and campus page identify it as Garfield Middle School after the district’s grade reconfiguration, although a stale secondary navigation entry and OpenStreetMap label still call the same campus Garfield Elementary.
Confidence and uncertainty
Confidence is high that the district experienced the reported network and communications outages. Facility-level impact links are medium confidence because the district described broad district systems but did not enumerate outages at each building. The public record does not establish unauthorized data access, theft or exposure. Confidence in the WorldLeaks attribution and extortion claim is low because the district has not corroborated it.
Analytic gaps
The public record does not establish whether the suspicious email activity involved phishing or account compromise, which systems were directly compromised, whether malware was used, the data scope, any ransom or payment details, or the exact final restoration date.
Threat actor and claim
Organizations involved
San Felipe-Del Rio Consolidated Independent School District
Locations
Organization type
Critical infrastructure
Impacted locations
Del Rio, Texas
Laughlin Air Force Base, Texas
Laughlin Air Force Base is the CDP/locality containing the Barrera STEM campus. The district described districtwide systems impact but did not enumerate that campus separately.
San Felipe–Del Rio Consolidated Independent School District, Texas
Sources
The district said suspicious email activity preceded outages affecting internet, phones, communications and data systems.
The district said phones were restored while teams monitored and restored remaining in-network communications, internet and data systems.
CYBERCRIME.works recorded a March 31 WorldLeaks victim listing naming San Felipe Del Rio CISD School and the sfdr-cisd.org domain. The listing does not establish ransomware deployment, data theft or actor responsibility.
The district identifies the Student Performance Center and Administration Building at 315 W. Griner St. in downtown Del Rio as its administrative office.
The official department directory places Career and Technical Education at 201 E. 10th St. and identifies the district’s other administrative addresses.
The current primary directory lists eight elementary schools, three middle schools, four high schools and the Student Guidance and Learning Center. Its linked campus pages provide current street addresses.
See something that needs correction?
Signed-in members can report an error, update, or missing source.