fog

A stable Fog-attributed listing names the school division’s exact domain, wjccschools.org, and alleges 27.7 gigabytes of stolen data. Comparitech’s March 7 reporting dates the claim to the previous day and says the division had not verified it. Tracker discovery is not original publication; the original claim publication timestamp is unknown. This is a low-confidence attribution claim, not proof of encryption, theft, actor responsibility or a demand received or paid by WJCC.

Ransomware.live indexes an alleged Fog victim listing for Aurora Public Schools and aurorak12.org, with an alleged 171 GB dataset. The tracker records discovery on Feb. 11, 2025, at 16:24:23.202750 UTC; that observation is neither a verified original actor-post publication time nor the attack date. No original actor post URL or supported attack date was supplied. The district independently acknowledged suspicious network activity and a precautionary shutdown in January, but the reviewed official statements do not confirm Fog attribution, encryption, theft, the contents or volume of any dataset, or a ransom demand or payment. Preserve this as a qualified external allegation with low actor and ransomware confidence. Reuse the existing Fog actor and claim; the same actor is already used for the separately reviewed Williamsburg-James City County schools allegation.