A ransomware gang called Inc over the weekend took credit for a last month’s cyber attack on the Valley View Independent School District in Hidalgo County, Texas.
The district on November 10 confirmed a cyber attack impacted its computer systems and phone lines.
In a post on its data leak website, Inc said it stole 68 GB of data in the attack on November 29, 2025. Inc gave Valley View about two weeks to pay an undisclosed sum in ransom. To prove its claim, Inc posted images of what it says are documents stolen from the district.
Valley View Independent School District has not verified Inc’s claim. We do not know how much Inc demanded in ransom, how attackers breached the district’s network, or what data was compromised. Comparitech contacted district officials for comment and will update this article if it replies.
“We want to inform you that our district is currently experiencing a cybersecurity incident that has affected our computer systems and phone lines. Please know that all students and staff are safe, and classes are continuing as normal,” says the district’s November 10 Facebook post.
Who is Inc?
Inc is a ransomware gang that first emerged in the middle of 2023 and has since targeted a wide range of victims in healthcare, education, and government. Its methods include spear phishing and exploiting known vulnerabilities in software. Inc employs a double-extortion scheme in which it both steals data and locks up infected systems, forcing victims to pay both for system restoration and the destruction of stolen data. Inc operates a ransomware-as-a-service business in which customers pay Inc to use its malware and infrastructure to launch attacks and collect ransoms.
Inc has taken credit for 547 attacks in total, 138 of which were acknowledged by the targeted organizations.
17 of Inc’s confirmed attacks hit the education sector, including four this year. They include:
- Centre de services scolaire des Appalaches (CSSA) in Canada reported an August 2025 data breach claimed by Inc
- University of St. Thomas in Texas reported nine days of outages following an August 2025 Inc attack
- The Ripley Academy and John Flamsteed Community School in the UK reported an October 2025 data breach claimed by Inc
In 2025 to date, Inc has claimed 51 confirmed attacks and made another 278 unconfirmed claims that haven’t been publicly acknowledged by the targeted organizations.
Last month, Inc took credit for attacks on Austrian bike manufacturer Woom and US emergency alert provider OnSolve.
Ransomware attacks on US education
In 2025 to date, Comparitech researchers have logged 43 confirmed ransomware attacks on US schools, colleges, and other educational institutions. Those attacks compromised about 219,000 records in total.
Other recent such attacks include:
- Mecklenburg County Public Schools reported a September 2025 data breach claimed by Qilin
- Harvard University reported an October 2025 data breach claimed by Clop
- Fowler Elementary School District 45 reported a May 2025 data breach claimed by Interlock
- Dartmouth College notified 35,000 people of an August 2025 data breach claimed by Clop
Ransomware attacks on schools and other education facilities can disrupt day-to-day operations such as taking attendance, submitting grades, phone and email communications, billing, payroll, and assignments. Ransomware attacks are often two-pronged: they lock down systems and steal data. Schools that refuse to pay can face extended downtime, lose data, and put students and faculty at increased risk of fraud.
About Valley View Independent School District
Valley View Independent School District is a public school district in Hidalgo County, Texas, about two miles away from the Mexico border. It should not be confused with another Texas school district with the same name in Cooke County.
This VVISD enrolls about 3,500 students and employs about 230 teachers in and around Pharr, Texas. It consists of one high school, one early college campus, one junior high, and four elementary schools.
