Analyst assessment
DysruptionHub assesses with high confidence that a malicious encryption incident disrupted the Starkville-Oktibbeha Consolidated School District’s network and classroom technology in early January 2025. In a Jan. 9 email quoted by The Commercial Dispatch, communications director Haley Montgomery described a “malware encryption event.” The district’s description, extended loss of network access and reported ransomware claim support high confidence in ransomware involvement. They do not independently establish SafePay attribution.
Operational significance
The district disabled network resources after detecting suspicious activity during winter break, according to its parent message described in Jan. 8 reporting. Students returned Jan. 7 without school internet access. The disruption affected the semester’s first two weeks, and teachers used textbooks, paper assignments and whiteboards in place of online teaching tools. Interviews with teachers documented inaccessible presentations, digital curriculum, printers and classroom computer exercises. Classes continued; the reviewed evidence does not establish cyber-related school closures.
Timeline and recovery
A public Ransomfeed alert on Reddit reported SafePay’s claim against starkvillesd.com on Dec. 29, 2024, Eastern time. Its original post timestamp is Dec. 30 at 04:04 UTC. This establishes a public external cyber allegation before the district’s Jan. 6 parent message; it does not establish when the intrusion began or when SafePay originally published its claim.
The Jan. 6 message remains the earliest verified dated district acknowledgment in the reviewed reporting. Ransomware.live records claim discovery late Dec. 29 UTC, while Breachsense labels discovery Dec. 30. Neither monitoring date establishes the intrusion’s start.
On Jan. 28, Montgomery said the network and internet access were functional, according to the Jan. 29 Dispatch report. Individual login and device troubleshooting remained. The resolved status refers to restoration of core network service, not proof that every device issue or privacy consequence had ended. No more recent continuing disruption tied to this occurrence was found during this review.
Attribution and extortion
SafePay’s monitored listing names the district’s matching starkvillesd.com domain. This supports a recorded actor claim, but the district did not publicly attribute its encryption incident to SafePay. The listing supplies no independently verified stolen-data volume, and unrelated exposed-credential counts are not evidence of this intrusion.
The district said it had not paid a ransom and did not intend to pay one. The reviewed statements do not establish a demand amount or negotiation terms.
Separate PowerSchool incident
Montgomery confirmed that the district was also affected by the PowerSchool vendor breach, but said there was no evidence the two events were related. That separate exposure does not establish data theft, affected data types or a victim count for this district-network incident.
Confidence and uncertainty
Confidence is high in the encryption incident, classroom disruption, offline workarounds and network recovery because district statements and named teacher accounts support them. Confidence in SafePay responsibility is low because attribution rests on monitoring records rather than a district or forensic finding. The Mississippi State Auditor’s October 2025 statement separately referenced the district’s late-2024 breach; it did not establish that the district failed the state-agency compliance review.
Analytic gaps
The initial access method, intrusion window, affected servers, encryption extent, data-access or removal findings, incident costs and final device-level recovery date remain undisclosed. Public claim-discovery dates do not resolve those gaps.
