Ransomware gang Nitrogen over the weekend took credit for a cyber attack earlier this month on a school district in Coweta County, Georgia.
On May 4, Coweta County School System issued a press release saying a network intrusion forced schools to take IT systems offline.
“Some school system network processes will be hampered in the coming days, and school system employees have been advised not to access desktop devices while the matter is being investigated,” says the press release.
Nitrogen has now claimed responsibility for the attack and says it stole data from CCSS. To prove its claim, Nitrogen posted images on its website of what it says are documents stolen from the school district. They include scans of a Social Security card, a driver’s license, and a school enrollment document.
Coweta Schools has not verified Nitrogen’s claim. The district said in its press release earlier this month that it did not appear that personal info was compromised, but an investigation was still underway.
We do not know if any personal data was breached, if Coweta Schools did or will pay a ransom, how much Nitrogen demanded, or how attackers breached the district’s network. Comparitech contacted school system officials for comment and will update this article if they reply.
Who is Nitrogen?
Nitrogen is a relatively new ransomware gang that began adding targets to its data leak site in September 2024. In a typical double-extortion scheme, Nitrogen forces victims to pay a ransom both for stolen data and to restore infected systems.
The group has claimed responsibility for seven confirmed attacks on organizations, plus 19 unconfirmed claims that haven’t been publicly acknowledged by the targets.
In 2025, Nitrogen took credit for confirmed attacks on French education company AKTO, Portuguese media holding company Global Media Group, and German utilities company Stadtwerke Schwerte.
Ransomware attacks on US education
Comparitech researchers have logged 18 confirmed ransomware attacks against US schools, colleges, and other educational institutions in 2025 to date.
Other recent such attacks include:
- Kalamazoo Public Schools in Michigan reported an April 2025 attack claimed by Interlock
- Bartlesville Public Schools in Okloahoma reported a May 2025 attack by unknown attackers
- Albion College notified 6,930 people of a December 2024 data breach claimed by Medusa
- Alvin Independent School District notified 47,600 people of a June 2024 data breach claimed by Fog
Ransomware attacks on schools and colleges can disrupt day-to-day operations such as taking attendance, submitting grades, phone and email communications, billing, payroll, assignments, and more. Ransomware attacks are often two-pronged: they lock down systems and steal data. Schools that refuse to pay a ransom face extended downtime, data loss, and putting students and faculty at increased risk of fraud.
Our research shows schools take an average of 4.8 months to notify victims of data breaches, longer than any other sector.
About Coweta County School System
Coweta County School System enrolls more than 23,000 students at 34 schools in Coweta County, Georgia, including five high schools, nine middle schools, and 19 elementary schools. It employs nearly 3,000 staff.
