Valdosta State University
Valdosta State University intrusion disrupts campus systems
Summary
A December 2024 network intrusion prompted Valdosta State University to shut down campus IT, close offices and modify in-person instruction. Recovery proceeded in stages; later findings identified stolen files and affected testing records.
Key facts
Timeline
-
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted location
Organization types
Critical infrastructure sector
Incident characteristics
Assessments
Attack mechanisms
-
Unauthorized access
Unauthorized access to systems, accounts, networks, or data.
-
Malware
Malicious software other than ransomware used to compromise or disrupt systems.
Data impacts
-
Data theft or exfiltration
Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Complete service outage
A primary service, system, platform, or operational capability became entirely unavailable.
-
Partial service outage
A service, system, platform, or operational capability remained available only in part or with significant limitations.
-
Network outage
Internal or external network connectivity was unavailable or materially impaired.
-
Internet access disruption
The organization lost or materially restricted internet connectivity.
-
Email disruption
Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.
-
Phone service disruption
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
-
Online portal unavailable
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Application unavailable
A specific application or software platform became unavailable or unusable.
-
Educational operations disrupted
Instruction, student services, school administration, learning platforms, transportation, or other educational operations were materially affected.
-
Facility closure
One or more offices, schools, clinics, stores, plants, branches, or other facilities closed because of the incident.
-
Manual workaround required
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
-
Alternate service channel required
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
-
Staff unable to work normally
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
Valdosta State University’s network intrusion caused a broad campus IT shutdown and a prolonged, staged recovery. In its Jan. 7 statement, VSU said it detected the intrusion on Dec. 28, 2024, and disconnected the campus as a containment measure. The shutdown affected the network, internet, Wi-Fi and university systems. VSU worked with the University System of Georgia and an independent security firm.
A Feb. 19 report in The Spectator described a malware-containing ZIP file downloaded through a work-related template in late June 2024 and executed in December. IT chief Kevin Overlaur confirmed that an unauthorized party copied university files to external cloud storage. The report described the network as nearly fully recovered, without providing a complete restoration date.
Operational significance
VSU’s Dec. 31 closure notice extended office closures into Jan. 2–3. Staff used payroll and timekeeping workarounds, and the university directed emergency callers to an alternative number or Lowndes 911 because campus police phones were unavailable.
Reduced operations began Jan. 8. VSU said spring classes would begin Jan. 13 as scheduled, with online courses unchanged and face-to-face instruction modified because classroom technology was unavailable. Campus computers required IT clearance before reuse.
Recovery occurred by service. The Jan. 9 update reported restored police phones and direct access to selected student services, while MyVSU and campus computers remained offline. By Jan. 13, MyVSU and most telephone service had returned. File storage, several applications, alumni and retiree email, and other services were still unavailable.
Confidence and uncertainty
The university’s acknowledgment, operational notices and subsequent consumer notification establish a cyber incident with both availability and confidentiality effects. The consumer notice filed with Massachusetts says an unauthorized party accessed archives containing some assessment testing records from 2003–2005. Names and full or partial Social Security numbers may have been involved.
The Massachusetts breach report lists 12 affected residents in each of two related VSU filings. Those entries do not establish 24 distinct people or a nationwide total. Ransomware, encryption, extortion and a named attacker are not established by the reviewed evidence.
Analytic gaps
The exact date of the earlier malware introduction, the scope of all copied files and the total affected population remain uncertain. Near-complete recovery in February does not establish an exact end date. The available evidence also does not establish a common attack affecting other universities.
Organizations involved
Impacted location
Valdosta, Georgia
Valdosta contains the affected main university campus on North Patterson Street. Original university notices document campus-wide network containment, office closures and classroom/computer restrictions. This city-level site association does not identify an intrusion origin or assert an outage across the city or county. The university’s regional educational mission does not by itself establish an exclusive municipal or county governmental service jurisdiction.
Sources
See something that needs correction?
Signed-in members can report an error, update, or missing source.