Ransom Demanded After Slate Valley Breach Compromises Employee Data
The Slate Valley Unified School District faces an extortion attempt by the Kairos ransomware group, which is demanding hundreds of thousands of dollars after compromising personal information belonging to more than 1,500 current and former employees, including Social Security numbers and home addresses. The security incident began in early September, forcing the district offline for a week and prompting an ongoing investigation by the Federal Bureau of Investigation.
How the Cyber Attack Unfolded on District Servers
Teachers arriving at school on Sept. 3 discovered they could not log in to Microsoft Windows, signaling the initial breach. The network compromise knocked out internet access and internal platforms, including the grading system Powerschool, for a week. District leadership worked alongside cybersecurity contractors to restore connections, while hiring outside forensic experts to determine precisely which employee records were accessed.
Superintendent Brooke Olsen-Farrell noted that the district is paying cybersecurity firms hundreds of thousands of dollars to audit the damage. The school board denied making any ransom payments earlier in the week. Meanwhile, the FBI cautioned leadership against paying the extortionists, advising that payouts incentivize future attacks.
The Kairos Extortion Emails Targeting Staff and Media
The threat actors, identifying themselves as the Kairos ransomware group, sent emails to media organizations claiming possession of confidential staff files. “The personal info of more than 1,500 employees — including SSNs and home addresses and other highly confidential information is about to be leaked,” the group wrote in an email statement.
Similar messages under the name “Kairos Support Group” reached staff members and local community residents. Lindsey Hedges, policy and communications specialist for the Vermont Agency of Education, issued guidance urging recipients not to engage with the senders, click links, open attachments, or disclose personal and financial details.
Federal Investigation and Agency Response
Sarah Ruane, a spokesperson for the FBI’s Albany office, confirmed that federal agents are investigating and assisting the district. The bureau itself was recently hacked by a group eager to solicit the press in an incident that compromised the data of thousands of its employees.
The Vermont Agency of Education was reached out to by the district following the breach, though agency officials acknowledged they were not equipped to respond to the issue. The education agency is now working to ensure that district families and staff understand how to recognize suspicious outreach.
Next Steps for Affected Slate Valley Staff
District leadership is collaborating with a third-party outside consultant to cross-reference every impacted name and issue individual notifications to affected personnel. Superintendent Olsen-Farrell stated that the district expects its cybersecurity insurance policy to reimburse the costs associated with legal experts and external cybersecurity firms.
