School District 5 of Lexington and Richland Counties in South Carolina this week confirmed it notified 31,475 people of a June 2025 data breach that exposed the following info:
- Current and former names
- Social Security numbers
- Financial account info
- State-issued ID info (driver’s license, passport, etc)
- Dates of birth
The cyber attack forced the district to push back the start of high school summer classes. Year-end bonus checks were delayed due to disruptions in payroll, and district employees were locked out of their accounts.
Ransomware gang Interlock claimed responsibility for the attack. In a post on its data leak site, Interlock says it stole 1.3 TB of data from School District 5.
School District 5 has not verified Interlock’s claim. We do not know if the district paid a ransom, how much Interlock demanded, or how attackers breached the district’s network. Comparitech contacted School District 5 for comment and will update this article if it replies.
“On June 3, 2025, the District became aware of an incident involving our computer network,” says the school’s notice to victims. “As a result of the investigation, we determined that some files were taken from the network by an external unauthorized individual.”
School District 5 is offering victims free credit monitoring and $1 million in identity theft insurance through CyberScout. The deadline to enroll is 90 days from the date on the notice letter, which victims received or will receive in the mail.
Who is Interlock?
Interlock is a ransomware gang that first started claiming attacks on its leak site in October 2024. The group extorts targets both to unlock infected computer systems and to not sell or release stolen data.
Interlock has taken credit for 28 confirmed attacks since it began, compromising more than 4.4 million records.
Eight of Interlock’s confirmed attacks hit US schools and universities. Six of them occurred in 2025:
- Aztec Municipal School District (NM) closed schools in response to a February 24 ransomware attack
- Cherokee County School District (SC) reported more than week of disruptions following a March ransomware attack
- Kalamazoo Public Schools (MI) went without internet for days following an April 2025 ransomware attack
- Central Point School District 6 (OR) says a ransomware attack disrupted systems for nearly three weeks in May and June
- Christian Brothers Academy (NJ) reported a breach in June
Interlock claimed responsibility for another 35 attacks that haven’t been publicly acknowledged by the targeted organizations. Seven of those attacks hit schools and universities in 2025.
Ransomware attacks on US education
In 2025 to date, Comparitech researchers logged 29 confirmed ransomware attacks on American schools, universities, and other educational institutions.
Other such recent attacks include:
- Trico Community Unit School district #176 suffered an attack in early August 2025. Ransomware group Kairos took credit. The district told Comparitech that hackers gained access to a network driver folder, but that fewer than 50 people were impacted and no ransom has been paid.
- Prince George County Public Schools notified 3,959 people of a July 2025 data breach by unknown attackers
Ransomware attacks on schools and other education facilities can disrupt day-to-day operations such as taking attendance, submitting grades, phone and email communications, billing, payroll, and assignments. Ransomware attacks are often two-pronged: they lock down systems and steal data. Schools that refuse to pay can face extended downtime, lose data, and put students and faculty at increased risk of fraud.
About School District 5 of Lexington and Richland Counties
School District 5 of Lexington and Richland Counties in South Carolina consists of 13 elementary schools, two intermediate schools, three middle schools, four high schools, a technical school, and an alternative school. It employs about 2,450 people and enrolls about 27,000 students.
