Southwest Tennessee Community College
Southwest Tennessee ransomware disrupts classes and college systems
Summary
A July 2024 ransomware attack disrupted Southwest Tennessee Community College networks, postponed Summer II classes and restricted student and staff systems. In-person classes returned July 15, but system restoration continued into September and an October audit documented a records-access limitation.
Key facts
Timeline
-
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Ransomware
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Data impacts
-
Unauthorized data access
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Partial service outage
A service, system, platform, or operational capability remained available only in part or with significant limitations.
-
Network outage
Internal or external network connectivity was unavailable or materially impaired.
-
Internet access disruption
The organization lost or materially restricted internet connectivity.
-
Email disruption
Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.
-
Website unavailable
A public-facing website was unavailable, disabled, or inaccessible.
-
Online portal unavailable
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Application unavailable
A specific application or software platform became unavailable or unusable.
-
Authentication disruption
Users were unable to authenticate, sign in, access accounts, or use identity-dependent services.
-
Records access disruption
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
-
Records processing disruption
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
-
Educational operations disrupted
Instruction, student services, school administration, learning platforms, transportation, or other educational operations were materially affected.
-
Retail operations disrupted
Store, dealership, point-of-sale, inventory, fulfillment, or other retail operations were materially affected.
-
Facility closure
One or more offices, schools, clinics, stores, plants, branches, or other facilities closed because of the incident.
-
Service delay
Services continued but with longer processing, response, delivery, or completion times.
-
Manual workaround required
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
-
Alternate service channel required
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
-
Staff unable to work normally
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
-
Customer or public access restricted
Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.
Extortion indicators
-
Ransom demand
The victim received a demand for payment in exchange for restoring access, decrypting systems, preventing disclosure, or stopping another threatened action.
Incident narrative
Analyst assessment
Ransomware disrupted Southwest Tennessee Community College’s computer systems and educational operations in July 2024. The college initially described a server problem July 3 and publicly identified a broader cyber incident July 7. Its September forensic findings confirmed ransomware and unauthorized access to information held by the college. The responsible operator and initial intrusion method remain unverified.
Operational significance
The college’s dated updates document a network outage, remote work and learning, and a delayed start to Summer II classes. Registration was extended through July 19, while the longer summer term was extended a week to make up missed instruction. My.Southwest, PAWS and Banner were inaccessible. Email access depended on an existing logged-in session and an unexpired password; this was not a complete loss of every mailbox.
Transcript services and printing were restricted, and staff used manual timesheets while the normal timekeeping system was unavailable. The Macon Cove and Union Avenue child care centers stayed open. The college bookstore closed to in-person purchases while online ordering remained available. A separately mentioned air-conditioning problem is not established as a cyber effect.
In-person classes and work resumed July 15, as documented by the college and Action News 5, with continuing technical difficulties. The portal was operational with some links unavailable July 19; website files and features were still being restored July 31. President Tracy Hall’s August 26 message and the September 23 release described continuing restoration.
An October 11, 2024, Clery Act audit included in a Tennessee Board of Regents committee packet said the incident prevented verification of certain historical training and investigation records. This is a documented audit limitation, not proof that the entire network remained down through October or the February 2025 committee meeting.
The incident is presumed resolved based on its historical age and the absence of later concrete impairment in the reviewed evidence. No exact restoration date is established.
Confidence and uncertainty
The college confirmed access to information from certain affiliated businesses and said notification letters were issued. Its statement that it did not believe student or employee personal data was compromised is qualified.
The Daily Memphian reported July 16, citing an unnamed knowledgeable source, that a ransom was demanded and no money was paid. The college later said it did not engage with the criminal.
Analytic gaps
The responsible operator, initial access method and precise restoration date remain unverified. The reviewed evidence does not establish an affected-person count, data theft, public release or a ransom amount. The contemporaneous July 3 outage and the September release’s retrospective July 5 disruption date differ; neither establishes the first intrusion.
Organizations involved
Impacted locations
Fayette County, Tennessee
Fayette County is within the affected public college’s educational service area. The college’s systems and academic services were disrupted; this does not establish a countywide outage.
Fayette County contains the college’s historical Somerville instructional site at 214 Lakeview Road. The college’s disrupted network and academic services do not establish a separate intrusion into county government.
Memphis, Tennessee
Memphis contains the affected college’s Macon Cove and Union Avenue campuses. The incident disrupted college systems, classes and registration; it does not establish a citywide outage.
Shelby County, Tennessee
Shelby County contains the affected college’s Memphis campuses and historical 6500 Navy Road instructional center. College network and academic services were disrupted; a separate outage or restoration time for every building is not established.
The public college serves Shelby County. Disrupted systems affected access to its academic and administrative services; county government and unrelated services are not established as affected.
Somerville, Tennessee
Somerville contains the college’s historical Fayette instructional site at 214 Lakeview Road. The college’s systems and academic services were disrupted; a separate facility-specific restoration date is not established.
Sources
We reported that a cyber incident disrupted college networks and postponed Summer II instruction. Remote work and learning continued while campus child care stayed open.
The college announced a cyber incident July 7 after an earlier server problem. Summer II classes were postponed until July 15, registration was extended and child care remained open.
In-person Summer II classes resumed July 15 with registration continuing through July 19. The college warned that students could still encounter technical problems.
The report said a ransom was demanded and no payment was made, citing an unnamed person with knowledge of the incident.
The college president described continuing technical difficulties after the summer cyber incident and said the IT team was working to restore full functionality.
The college confirmed ransomware and access to information from affiliated businesses. It said affected parties had been notified and work to restore impacted systems continued.
An Oct. 11, 2024, internal Clery Act audit said the July 3 cyber incident prevented verification of supporting records for training and investigation outcomes.
Dated college updates document the July network outage, delayed instruction, manual workarounds and partial recovery. Later updates confirm ransomware and continuing system restoration.
See something that needs correction?
Signed-in members can report an error, update, or missing source.