Williamsburg-James City County Public Schools hit by cyberattack
The following FAQ shares information related to the recent cyber incident experienced by WJCC Schools.
Key points
- Cybersecurity incident occurred over the weekend of February 8-9, 2025.
- WJCC Schools announced the cyberattack on February 9, 2025.
- Fog ransomware gang claimed responsibility and stated they stole 27.7 GB of data.
Connected intelligence
Signal brief
Follow the organization, likely method and potential impact to explore connected Shadow Tier intelligence.
Organization
- Published
- Feb 9, 2025
- Updated
- Jul 22, 2026
- Confidence
- Medium
- Evidence
- 2 sources
Structured assessment
Signal analysis
This analysis groups the signal by industry, likely incident action and impacted security area. It helps compare this signal with other published signals without treating the labels as final determinations.
Threat source
Watch exposure paths that could affect data, operations or third-party trust.
- Source type: possible insider or internal misuse
Business impact
- Impact area
- Confidentiality
- Likely asset
- User or customer data
Mentioned entities
Quick context
Questions about this signal
What happened in this signal?
The following FAQ shares information related to the recent cyber incident experienced by WJCC Schools. If you have further specific questions about the incident, we have established a dedicated email address that members of our leadership team monitor. Please feel free to contact questions@wjccschools.org. WJCC Schools noticed network disruptions to our system over the weekend (Feb. 8-9). Thanks to the quick response from our internal technology team, which immediately engaged outside cybersecurity experts, we determined that, like many schools recently, we were the victim of a cybersecurity incident. Does this cyber incident impact the security of our school campuses? We are grateful that this incident did not impact the physical security of any of our campuses or facilities, including our alarm and phone systems. Our talented teachers and staff should also be credited with minimizing this distraction by prioritizing offline learning. What did WJCC do when learning of the incident? We immediately engaged with some of the country’s leading cybersecurity professionals who manage incidents like this daily. We also notified local and federal law enforcement and are helping them with their criminal investigations. We are regularly communicating with our families and staff about the incident, and we are committed to providing updates as information becomes available. Why are school systems susceptible to cyber incidents like this one? Any organization that holds sensitive data is at risk for cyber threats. Unfortunately, cybercriminals have targeted school systems across the country. We are using this incident to bolster our cybersecurity posture and prevent future distractions to our learning environment. When will the investigation be complete? When will we learn more? These investigations typically happen over several weeks but understanding how this happened and restoring all operations are priorities. Is this related to the PowerSchool breach late last year? What is WJCC doing to make sure this doesn’t happen again? Part of the support that we are receiving from outside cybersecurity consultants and legal counsel includes proactive measures that we can take to boost our ability to detect and respond to cyber threats. Unfortunately, school systems are particularly susceptible to incidents like this, and we take our responsibility to protect our community – even through cyber threats – seriously. Do I need to reset my password on my WJCC-issued device? All WJCC members will reset their passwords to their devices. More information on this will be coming soon. Please do not take any action until we have a chance to roll out the process with the advice of our internal technical team and outside experts. '+comparitech_frontend_data.translations["comments-submitted-published-after-approval"]+"
When was this signal reported?
Shadow Tier lists Feb 9, 2025 as the signal date.
Which organization is connected to this signal?
Wjccschools is the organization connected to this public signal.
Explore WjccschoolsRelated signals
Compare shared topics, actors and incident patterns before opening the full signal.
CEVA Logistics Data Breach Impacts DELTA Fiber Nederland Partner, De Bijenkorf, Affecting Customer Data and Operations
On August 11, 2026, it was reported that a data breach at CEVA Logistics, a logistics partner, had impacted several companies, including De Bijenkorf, a partner of DELTA Fiber Nederland. The incident led to significant delays in processing orders, returns, and refunds for De Bijenkorf customers. The breach potentially exposed personal data of customers across the affected companies. The Dutch data protection authority (AP) received twelve notifications from companies regarding potentially leaked customer data due to their collaboration with CEVA. While the full extent of the data compromise is still under investigation, companies like De Bijenkorf have informed customers that unauthorized parties may have accessed their personal information. DELTA Fiber Nederland, as the parent company of ZeelandNet which reported on the incident, is indirectly connected to this supply chain breach through its partner's reliance on CEVA Logistics. The incident highlights the widespread impact of supply chain attacks on various businesses and their customers.
Related context
Origin Energy Discloses Data Breach Affecting 900,000 Customers
On July 28, 2026, Origin Energy, a major Australian energy company, publicly confirmed a significant data breach impacting approximately 900,000 current and former customers. The breach led to unauthorized access and exfiltration of personally identifiable information (PII), including names, addresses, dates of birth, phone numbers, account details, and partial payment information such as the last four digits of credit cards or the BSB and last three digits of bank accounts. Origin Energy first identified a potential security threat in early July 2026, which was initially not deemed credible. However, new information on July 22, 2026, confirmed a security incident had occurred, prompting immediate action and notification of authorities. An alleged hacker provided a media outlet with a sample of 50 customer records and screenshots of internal Origin Energy systems, corroborating the data exfiltration. The incident is currently under investigation by Australian authorities, including the Australian Cyber Security Centre, the National Office of Cyber Security, the Australian Federal Police, and the Office of the Australian Information Commissioner. The specific technical vector used for initial access remains undisclosed.
Related context
Municipality of IJsselstein Takes Files Offline Due to Data Leak
The municipality of IJsselstein removed several documents from its website on July 27, 2026, after a resident discovered that they contained personal data. These documents were found within the municipal council's information system, which violates privacy legislation. The municipality has reported the incident to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and is reviewing all published meeting documents dating back to January 1, 2014. While affected individuals will be informed, the specific types of data exposed have not been disclosed. Locoburgemeester Peter Bekker emphasized the need to restore trust in the handling of personal data and prevent future occurrences. An investigation into the error is expected to take several months, during which parts of the system may be temporarily inaccessible.
Related context
Iowa State University's Canvas Learning Platform Breached, Student Data Exposed
Iowa State University's Canvas learning management system was breached on July 26, 2026, displaying a hacker message that blocked access to the website and all its pages. The message advised users to "consult with a cyber advisory firm" and to "contact us privately at TOX to negotiate a settlement." This incident is part of a larger series of over 9,000 attacks affecting various educational institutions. The hackers, identified as the criminal extortion group ShinyHunters, had previously caused an outage on Canvas and are also linked to data thefts from Ticketmaster and Google. The compromised data includes names, email addresses, student ID numbers, and internal messages. Iowa State IT Security issued an email addressing the outage and advised students to seek alternative submission methods for coursework. The university's news service director, Angie Hunt, confirmed that Iowa State is one of many institutions affected by a nationwide Canvas platform outage. Instructure, the parent company of Canvas, has not provided a timeframe for resolving the issue. The group ShinyHunters claimed to have stolen over 3.65 terabytes of data, encompassing approximately 275 million records belonging to students, teachers, and staff, and threatened to release this data if their demands were not met. While the affected data may include full names, email addresses, student ID numbers, and messages, there is no evidence that passwords, dates of birth, government identifiers, or financial information were exposed. The sensitivity of some Canvas messages, which can contain medical and mental health information, adds to the concern. Officials are advising students, parents, and staff to be cautious of unsolicited messages claiming to be from Canvas or the university that request personal information or prompt immediate action. They also recommend monitoring accounts for unusual activity.
Related context
South Korean Domain Registrar Gabia Hacked, Exposing 350,000 User Records
South Korean domain registrar Gabia experienced a cyberattack on Saturday, July 26, 2026, which impacted the online connectivity of approximately 100,000 registered domains. The incident led to the exposure of data belonging to 350,000 users. The compromised information included names, user IDs, passwords, and registration numbers. This breach highlights the significant risks associated with compromised credential reuse, as a large portion of the exposure originated from "Combolist sources." Additionally, active infostealer activity, linked to malware families such as LummaC2, Redline, and Rhadamanthys, was identified, further indicating a focus on credential theft impacting both clients and employees. The incident also revealed 245 compromised employee accounts, posing an infrastructure risk, and 30,782 leaked client credentials, creating regulatory liability. The timeline of related events showed an increase in client-related incidents from August 2025 through April 2026, with a peak in March 2026, and spikes in employee-related events in January, April, and May 2026. Remediation efforts should prioritize credential hygiene, multi-factor authentication enforcement, and enhanced monitoring for suspicious login activity, particularly targeting login forms and account management services. The incident was reported by the Korea Herald on Monday, July 28, 2026.
Jamf Affected by Klue Customer Data Incident
Jamf, a company specializing in Apple device management, was among roughly two dozen Klue customers impacted by a data incident. The incident, which became active on July 26, 2026, involved the Icarus threat group claiming responsibility for an attack. Further reports indicated that another hacking group might have obtained samples of the stolen Klue customer data and attempted to extort affected companies directly. While the full extent of Jamf's specific exposure through this third-party incident is not detailed, the broader event highlights the risks associated with supply chain compromises. Jamf's security efforts include initiatives like its Beacon threat-hunting service, which focuses on proactive detection and analysis of Mac threats, and its annual Security 360 report, which addresses key threats to Apple endpoints.