A February 2025 cyberattack disrupted Williamsburg-James City County school networks and required offline instruction. The division reported network restoration on or about Feb. 14, but later snow-closure notices linked continued remote-learning limits to the outage. Fog’s claimed data theft remains unverified, and no exact universal recovery date is established.
The incident is confirmed to be cyber-related, but the specific attack mechanism is unknown.
The incident is cyber-related, but available evidence does not establish whether or how data was affected.
Services remained available but with reduced performance, reliability, functionality, capacity, or responsiveness.
Internal or external network connectivity was unavailable or materially impaired.
The organization lost or materially restricted internet connectivity.
Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.
Instruction, student services, school administration, learning platforms, transportation, or other educational operations were materially affected.
Scheduled events, meetings, hearings, classes, procedures, programs, or other activities were canceled.
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
A cyberattack disrupted Williamsburg-James City County Public Schools’ network in Virginia in February 2025. The division’s official FAQ describes disturbances over the Feb. 8–9 weekend. Acting Superintendent Daniel Keever acknowledged the incident in a family letter reproduced publicly Feb. 11, and his statement was also reported by WAVY. The original intrusion date remains unknown.
The Feb. 11 closure was weather-related. Keever’s letter said schools would reopen Feb. 12 for in-person instruction without internet or staff email, with families directed to call school offices. Teachers used offline instruction while specialists worked on the network. Campus physical security, alarms and phones were unaffected.
In the Feb. 18 school board minutes, Keever said systems had been secured and operations restored on or about Feb. 14. That qualified technical milestone did not mark the end of every instructional consequence. A Feb. 18 school notice said staff and students were still being brought back online and announced no remote learning during the next day’s snow closure.
The Feb. 19 notice explicitly connected the inability to offer remote learning that week to the prior network outage. The Feb. 20 notice repeated that limitation for Feb. 21 and changed March 3 to an in-person student attendance day because of the combined weather and network disruptions. The snow closures were not attributed to the cyberattack; the loss of a remote-learning alternative was.
The historical incident is presumed resolved, but no exact end date covering all these effects is established. Network restoration, readiness to deliver remote instruction and a later makeup day are separate milestones.
Cyber involvement and educational disruption are established with high confidence by the division’s own records. Outside cybersecurity specialists and local, state and federal law enforcement assisted. The division said the event did not appear related to the separate PowerSchool breach.
Fog later claimed the school system. A stable exact-domain tracker entry was discovered March 6. Comparitech’s March 7 report described Fog’s allegation of 27.7 gigabytes of stolen information and an unspecified demand, while stating that WJCC had not verified the claim. These are allegations, not confirmed theft, encryption, attacker responsibility or a demand received by the division. Tracker discovery is not original publication.
The board announced a year of credit monitoring and identity restoration for students and staff. Keever later confirmed that provision in a direct response to Comparitech and described four days of offline learning. Offering monitoring does not itself establish a breach, affected-person count or the kinds of information taken.
The entry route, precise intrusion date, confirmed data findings, responsible operator, ransom or payment outcome and incident-specific costs remain unverified. The Feb. 8–9 disturbance window is not an exact onset date. The division’s approximate Feb. 14 restoration statement is retained alongside its later, explicit instructional limitations; neither is used to infer a precise universal end date.
A stable Fog-attributed listing names the school division’s exact domain, wjccschools.org, and alleges 27.7 gigabytes of stolen data. Comparitech’s March 7 reporting dates the claim to the previous day and says the division had not verified it. Tracker discovery is not original publication; the original claim publication timestamp is unknown. This is a low-confidence attribution claim, not proof of encryption, theft, actor responsibility or a demand received or paid by WJCC.
The joint school division serves James City County. Its official joint-school agreement and Virginia education directory identify Williamsburg and James City County together as one school system. This existing constituent jurisdiction is one part of the combined remit, not the entire division and not evidence of a community-wide outage.
Williamsburg is the division’s central-office municipality. The joint-school agreement expressly identifies 117 Ironbound Road as a city facility located in Williamsburg. This physical anchor is distinct from the division’s two-jurisdiction service remit.
The joint school division serves the independent city of Williamsburg. Its official joint-school agreement and Virginia education directory identify Williamsburg and James City County together as one school system. This existing constituent jurisdiction is one part of the combined remit, not the entire division and not evidence of a community-wide outage.
Signed-in members can report an error, update, or missing source.
