Tag: US

On March 9, 2026, the Community College of Beaver County (CCBC), located in Center Township, Pennsylvania, experienced a significant cybersecurity incident involving an encryption-based “cryptolocker” attack. The college’s IT resources were promptly locked down to contain the damage as officials warned of malicious actors targeting the institution’s data. The attack was detected on the first day of the college’s spring break, which may have mitigated immediate disruptions to classes and campus activities.

The college communicated internally that the attack involved encryption of data, instructing employees not to power on laptops or other devices on campus to prevent further infection. This precautionary measure was intended to limit the spread of the ransomware, which encrypts files and typically demands a ransom payment for decryption keys. Despite these alerts, CCBC has not publicly disclosed which specific systems were affected or whether any data was accessed or exfiltrated during the attack.

As a public community college serving Beaver County, CCBC’s operations rely heavily on digital systems that manage sensitive information such as grades, transcripts, and financial records. Although the full scope of the disruption remains unclear, the encryption-based attack likely impacted access to these critical services. The college’s decision to lockdown IT infrastructure and issue warnings highlights the severity of the incident, even though no ransom note or claim of responsibility has been publicly confirmed at this time.

The institution engaged cybersecurity professionals and its insurance provider immediately following the incident and notified federal law enforcement agencies, including the FBI, as well as local police. These steps are consistent with best practices in responding to ransomware attacks, aiming to contain the threat, investigate the breach, and plan for recovery. As of the latest reports on March 10, 2026, the investigation was ongoing, and no public timeline for restoration was provided. The campus is scheduled to reopen on March 16, although it remains uncertain how fully operational the IT systems will be by that date.

While CCBC has not named the threat actor or ransomware group responsible for the attack, the use of cryptolocker-style malware aligns with tactics commonly employed by cybercriminal groups that target educational institutions. Pennsylvania’s education sector has faced similar cyber threats recently, including a malware incident at the Minersville Area School District in December 2025 and a ransomware attack on the Interboro School District in November 2024. These events underscore the increasing risk of cyberattacks on academic institutions, which often manage large volumes of sensitive personal and financial data.

For organizations seeking to protect themselves against similar ransomware threats, several key recommendations emerge from this incident:

• Implement comprehensive backup strategies: Regularly back up critical data offline and test restoration procedures to ensure business continuity in the event of encryption or data loss.
• Strengthen endpoint security: Deploy advanced antivirus and anti-malware solutions, alongside network segmentation, to detect and isolate threats rapidly.
• Enforce strict access controls and user training: Limit user permissions based on roles and educate staff on phishing and social engineering tactics commonly used to deliver ransomware.
• Develop and practice incident response plans: Establish clear protocols for identifying, containing, and reporting cyber incidents, including coordination with law enforcement.
• Keep systems and software updated: Apply security patches promptly to reduce vulnerabilities that attackers can exploit.

Educational institutions should also consider engaging cybersecurity experts and insurance providers proactively to strengthen their resilience against ransomware attacks. The CCBC incident highlights the importance of rapid detection and containment measures to reduce potential damage and operational disruption.

Sources: DysruptionHub, Ransomware.Live

Source: Community College of Beaver County locks down systems after cyberattack in Pennsylvania | Data from Ransomware.live | Generated with AI assistance

Rusk County, located in northwest Wisconsin, announced on March 11, 2026, that it is investigating a cybersecurity incident affecting its network environment. County officials have engaged forensic experts to assess the scope of the incident and assist in restoring operations within a secure and remediated network environment. While the county’s public website and online payment pages remain accessible through third-party processors, authorities have not yet identified which internal systems were impacted or whether any sensitive data was compromised.

The incident was publicly disclosed via statements from Rusk County and reported by local news outlets WEAU and WQOW. According to the county’s announcement, the investigation and comprehensive assessment may take several weeks to complete. However, officials have not confirmed if any resident-facing services were disrupted nor have they revealed details about potential data breaches involving community or employee information. The county reiterated its commitment to protecting information security and data privacy throughout the process.

Rusk County’s domain, ruskcounty.org, had appeared on a ransomware leak tracking site in December 2025 as a potential victim of the Lynx ransomware group, but county officials have not confirmed any connection between this earlier listing and the current incident. No ransom demands, claims of responsibility, or details about the attack vector have been disclosed by county authorities. The county also did not respond to requests for additional comment, and there is no public indication of law enforcement involvement at this time.

Rusk County serves a population of approximately 14,188 residents, with its county seat in Ladysmith. The county government center houses various offices and the courthouse, making the network disruption potentially significant for local administrative functions. Public-facing services, including online payments, are still operational through third-party platforms, but it remains unclear if internal systems managing records, payments, or other operations were affected.

This incident is part of a broader pattern of cyber disruptions reported among Wisconsin public entities in recent months. For instance, other counties have experienced network outages and suspicious activity affecting permitting and records access, though emergency services have generally remained operational. However, Rusk County has not provided specifics on whether this incident relates to those events.

Given the limited information currently available, organizations—particularly in the public sector—should consider the following recommendations to protect themselves against similar cybersecurity threats:

• Engage cybersecurity professionals promptly: Early involvement of forensic and incident response experts is critical to assessing the scope of an intrusion and initiating remediation efforts effectively.
• Maintain segmented and resilient network environments: Network segmentation helps contain breaches and limits the spread of malware or unauthorized access within internal systems.
• Ensure regular backups and test restorations: Reliable, offline backups enable organizations to restore data and services without yielding to ransom demands.
• Monitor for threat actor activity: Stay informed about emerging ransomware groups, such as Lynx, and use threat intelligence to anticipate potential attack vectors and targets.
• Educate employees on cybersecurity hygiene: Phishing campaigns and social engineering remain common attack vectors; comprehensive training reduces risk exposure.
• Implement multi-factor authentication (MFA): MFA strengthens access controls, making unauthorized network access more difficult for attackers.

While Rusk County’s investigation continues, the incident underscores the ongoing challenges public sector organizations face in defending against evolving cyber threats. Transparency in incident reporting and timely communication with affected stakeholders remain essential to managing impacts and maintaining public trust.

Sources: DysruptionHub, “Rusk County, Wisconsin probes cybersecurity incident,” published March 11, 2026, dysruptionhub.com.

Source: Rusk County, Wisconsin investigates cybersecurity incident | Data from Ransomware.live | Generated with AI assistance

On March 12, 2026, Hanover County Public Schools (HCPS) in Virginia experienced a significant cybersecurity-related disruption that impacted internet access and multiple internal systems across the school district. While the exact nature of the incident remains officially unconfirmed, HCPS described it as a “possible data incident” or “potential data breach,” leading to precautionary shutdowns and a temporary suspension of technology use in classrooms.

The incident caused an immediate interruption of internet services and forced the district to disable staff and student access to various internal platforms. Notably, student Chromebooks, which operate on a separate domain, did not appear to be directly affected; however, as a precautionary measure, the district temporarily disabled their use. HCPS announced that instruction would continue without technology for at least one week, emphasizing a shift to offline teaching modalities during the investigation period.

HCPS engaged cybersecurity experts, external legal counsel, and coordinated with state and federal authorities to investigate and resolve the situation. However, the district has not disclosed specific details about the attack vector, the presence of any ransomware, or whether any sensitive data was accessed or exfiltrated. According to official statements, there is no confirmation of ransomware involvement or data theft at this time. The district continues to work diligently with partners to restore affected systems and assess the full scope of the incident.

The affected organization is a public K-12 school district serving Hanover County, Virginia, which includes multiple elementary, middle, and high schools. The disruption impacted faculty, administrators, and students by limiting access to key digital resources and forcing a temporary return to non-digital instructional methods. Families were advised to communicate with schools via telephone, reflecting the limited online capabilities during the outage.

While no threat actor or ransomware group has been identified or claimed responsibility, cybersecurity analysts speculated that common attack vectors in education sector incidents—such as phishing campaigns or exploitation of unsecured technology—could be relevant, though this remains unconfirmed by HCPS or law enforcement.

This incident is consistent with a broader pattern of cybersecurity disruptions affecting Virginia K-12 schools since late 2025, underscoring the ongoing vulnerabilities in educational institutions’ IT infrastructure and the increasing threat landscape targeting this sector.

Given the available information, organizations—particularly those in the education sector—should consider the following recommendations to mitigate similar risks:

• Implement robust cybersecurity training: Educate staff and students to recognize phishing attempts and other social engineering tactics commonly used to gain unauthorized access.
• Enhance network segmentation: Separate student devices and administrative systems to contain potential breaches and reduce attack surfaces.
• Maintain up-to-date backups: Ensure regular, secure backups of critical data to enable rapid recovery in the event of ransomware or data loss incidents.
• Engage in continuous monitoring: Deploy tools to detect unusual network activity promptly and respond to potential threats before they escalate.
• Coordinate with authorities: Establish relationships with local and federal cybersecurity agencies to facilitate timely assistance and intelligence sharing.

HCPS has pledged to provide updates as their investigation progresses and systems are restored. This incident highlights the critical importance of preparedness and resilience in protecting educational environments against evolving cyber threats.

Sources: Hanover County Public Schools Technology Update (https://www.hcps.us/events/what_s_new/technology_update__march_2026), Ransomware.Live summary, Perplexity Research analysis.

Source: Technology Update: March 2026 | Data from Ransomware.live | Generated with AI assistance

On March 14, 2026, the DeKalb County Sheriff’s Department and Jail in Smithville, Tennessee, experienced a ransomware attack that disrupted key operational systems. The incident affected their main computer server, causing significant interruptions to critical functions, including email communications and inmate booking processes. The attack was detected early Friday morning when staff noticed the inmate intake booking software suddenly stopped working.

The ransomware compromised the department’s ability to manage jail bookings and access routine email services. Although there were concerns about potential data loss, Sheriff’s Department officials were able to recover the booking data by coordinating closely with their inmate booking software vendor. This recovery effort was reportedly completed by Friday evening of the same week.

At this time, no specific information has been released regarding any stolen or exfiltrated data. Additionally, there have been no public claims of responsibility from any ransomware group or threat actor. The initial method of intrusion remains undisclosed, and technical details about how the attackers gained access to the Sheriff’s Department systems have not been shared publicly.

In response to the attack, the DeKalb County Sheriff’s Department engaged a third-party cybersecurity firm to conduct a thorough evaluation and assist with ongoing data recovery and investigation efforts. Law enforcement authorities, including the Federal Bureau of Investigation (FBI) and the Tennessee Bureau of Investigation (TBI), are actively involved in the case. Sheriff Patrick Ray noted that the incident could be linked to broader foreign cyberattacks targeting law enforcement agencies, although this connection has not been confirmed and remains speculative.

The disruption caused by the ransomware attack had an immediate operational impact on the Sheriff’s Department, particularly in managing jail intake procedures. While the booking data was restored, the duration and extent of email system outages were not specified. Sheriff Ray also mentioned that a similar cyber incident affected another unnamed sheriff’s department within Tennessee, suggesting a possible pattern of attacks against regional law enforcement institutions.

Given the sensitive nature of law enforcement operations and the critical role of digital systems in managing jail bookings and communications, this incident underscores the importance of robust cybersecurity measures in the public safety sector. Organizations in similar sectors should consider the following recommendations to mitigate risks from ransomware and other cyber threats:

• Regular Data Backups: Maintain frequent, secure backups of all critical data, including inmate booking information and communication records, to enable rapid recovery in the event of a ransomware attack.
• Incident Response Planning: Develop and routinely update comprehensive incident response plans that include coordination with vendors, law enforcement, and cybersecurity experts.
• Employee Training: Conduct ongoing cybersecurity awareness training to help staff recognize phishing attempts and other common attack vectors that could lead to unauthorized access.
• System Updates and Patch Management: Ensure all software, including booking and email systems, are regularly updated and patched to minimize vulnerabilities.
• Network Segmentation: Implement network segmentation to limit the spread of malware within critical infrastructure systems.
• Engage Law Enforcement Early: Report cyber incidents promptly to appropriate law enforcement agencies to leverage their investigative resources.

While the full scope and attribution of this ransomware attack remain under investigation, the incident serves as a reminder of the increasing cyber threats faced by law enforcement agencies. Maintaining vigilance and adopting layered cybersecurity defenses are essential steps to protect public safety operations from disruption.

Sources: WJLE Radio, Ransomware.Live, and Perplexity Research analysis of publicly available information as of March 18, 2026.

Source: Sheriff’s Department and Jail’s Main Computer Server Hacked – WJLE Radio | Data from Ransomware.live | Generated with AI assistance