Seminole County School System in Georgia took technology systems offline after detecting unusual activity Oct. 19, bringing in outside cybersecurity specialists to investigate and restore access.
Ransomware group Global Secret Group claimed “Seminole Schools” as a victim, but its listing conflates school districts in three states. It gives a Florida location and an Oklahoma school website, while the sample documents identify Georgia’s Seminole County School System.
The district described an ongoing disruption in an Oct. 20 notice signed by Superintendent Mark Earnest.
“Our investigation is ongoing, and right now we do not know whether any information was affected,” the notice said.
The notice did not identify the applications taken offline or say whether classes, transportation or instruction were interrupted. The district, based in Donalsonville in southwest Georgia, enrolled 1,332 students in 2024-25, according to federal education records.
The group, also known as GSG, operates a leak site with victim profiles, sample documents and downloadable files. In its Seminole Schools listing, it claims 39.6 gigabytes of data across 54,468 files and labels the material as released.
The samples include accounts using the Georgia district’s seminole.k12.ga.us email domain and a Georgia Department of Audits and Accounts agreement naming Mark Earnest and Sherry Gray. The district’s staff directory identifies Earnest as superintendent and Gray as financial director.
Other images show apparent financial records, an identity document, a camera view and server-management screens.
Chip in once
If this reporting helped you, a one-time tip helps cover hosting, tools and future investigations.
Support us monthly
A small monthly pledge keeps independent coverage and our reader tools online for everyone.
A similar mix-up surfaced in March when ransomware group Interlock named Goodwill Industries of North Central Pennsylvania in a victim claim. A Michigan tax certificate in the posted material instead identified Goodwill of Greater Grand Rapids and listed a Grandville address, pointing to the Michigan affiliate.
The district did not respond to a request for comment before publication. It has not publicly identified an attacker or confirmed whether data was stolen or files were encrypted.
As of Oct. 28, we had not found a district update confirming full restoration.
