Hackers appear to sell data stolen from Rutherford County Schools

RUTHERFORD COUNTY, Tenn. (WKRN) — A group of hackers appears to be selling data collected from Rutherford County Schools (RCS).

RCS reported that the district experienced a network interruption last week; the district employed workarounds like delaying end-of-course exams and offering extra time for assignments.

Now it appears the interruption was a ransomware attack because a website linked to a ransomware gang claims to be selling the data. 

On Wednesday, an auction webpage with the logo of the hacker group "Rhysida" was posted on the dark web. The seven-day auction site listed a price of 20 Bitcoin, or about $2 million, as the price for the data. The hackers posted several documents from what they called "exclusive, unique and impressive data."

One of those documents appears to belong to a current RCS teacher.

"Rhysida" has been linked to attacks on the city of Columbus, Ohio, the Seattle-Tacoma International Airport and other ransomware attacks.

A statement from RCS addressed the hack Wednesday, saying that the district has worked with national experts and law enforcement to fully investigate the matter and that the investigation is ongoing.

Rutherford County Schools experienced a network and systems disruption on Nov. 25, 2024. Our teams have worked diligently to restore those services, and most are back to full functionality using our backup and recovery procedures.

The school district has been working with national experts and law enforcement to fully investigate the matter, and that investigation is ongoing. 

This morning, we were notified that the party believed to have caused the disruption has now made a post online claiming to have some employee personal data, and it appears some files were obtained pertaining to certain employees. This claim is being fully investigated, and to the extent it is determined that any employee personal information was affected by this event, we will notify those employees who were affected in accordance with applicable law.  

To our knowledge, there has been no posting of student personal data, and our investigation to date has not found that student personal data has been obtained from our student information computers.

In the meantime, our schools continue to operate normally and are focused on the academic goals for our students.

Statement from RCS

The Tennessee Bureau of Investigation (TBI) previously said the agency was working to investigate the network disruption. News 2 has reached out to the TBI for more details on Wednesday's development.