The Pell City School System in Alabama this week notified parents about a data breach caused by a ransomware attack that occurred late last year.
Superintendent Justin Burns said that the student information system was not affected but that a third-party did steal data in a “security incident”. The district did not provide further details about the compromised data.
A cybercriminal group called SafePay took credit for the breach in December 2025.
Pell City Schools has not verified SafePay’s claim. We do not know how much SafePay demanded in ransom, what data was compromised, or how attackers breached the district’s network. Comparitech contacted Pell City School System for comment and will update this article if it replies.
In a notice sent to families, Burns said the school system will not pay the ransom, , reports WBRC.
Who is SafePay?
SafePay is a ransomware gang that started adding targeted organizations to its data leak site in November 2024. The group uses LockBit-based ransomware. It employs a double-extortion scheme in which a ransom is demanded to restore systems and to delete stolen data.
SafePay has taken credit for 57 confirmed ransomware attacks since it began, plus 423 unconfirmed claims that haven’t been publicly acknowledged by the targeted organizations.
In 2025, SafePay hit four other schools:
- Harrison County Board of Education, WV – January 2025
- Gymnázium a Jazyková Å¡kola ZlÃn, Czech Republic, May 2025
- Ridgefield Public Schools, CT, July 2025
- Istituto Comprensivo di Cavaglià , Italy, November 2025
The group recently claimed responsibility for an attack on the UK trade union Usdaw, which forced systems offline between December 4 an 17, 2025.
Ransomware attacks on US schools
Comparitech researchers logged 48 confirmed ransomware attacks on US schools, colleges, and universities in 2025, compromising more than 3.8 million records.
The majority of those records stemmed from a single breach at the University of Phoenix, which notified nearly 3.5 million people after an attack by Clop in August 2025.
Other school districts facing ransomware attacks include Oakland Community School District 5 in Illinois and the Minersville Area School District in Pennsylvania. No ransomware groups have publicly claimed those attacks. Oakland, like Pell City, said it refused to pay the ransom.
Ransomware attacks on schools can both steal data and disrupt day-to-day operations such as taking attendance, submitting grades, phone and email communications, billing, payroll, and assignments. Schools that refuse to pay can face extended downtime, permanent data loss, and putting students and faculty at increased risk of fraud.
About Pell City School System
The Pell City School System is a public school district in St. Clair County, Alabama. It consists of Pell City High School, Duran Junior High, Williams Intermediate School, one pre-K school, and four elementary schools.
