LockBit Ransomware Group Claims Attack on Alcorn School District in Mississippi
The Russia-based ransomware gang LockBit has taken responsibility for a cyberattack on Alcorn School District in Mississippi, which disrupted the district’s network earlier this month. On March 1, the district announced it had disabled its systems after detecting "suspicious activity" that caused service disruptions. LockBit later claimed the attack on its data leak site, demanding an undisclosed ransom within two weeks though the district has not confirmed the group’s involvement, and key details, including the breach method, ransom payment status, and compromised data, remain unclear.
LockBit, active since 2019, is known for deploying ransomware that both encrypts systems and exfiltrates data. The group has targeted high-profile organizations, including Boeing, TSMC, and London Drugs, and has increasingly focused on K-12 school districts. In 2026 alone, LockBit has claimed 72 ransomware attacks, with eight confirmed by victims. Recent school targets include districts in Connecticut, Oregon, New Jersey, California, and Illinois, among others.
Ransomware attacks on educational institutions can severely disrupt operations, affecting attendance tracking, grading systems, communications, payroll, and student assignments. Schools that refuse to pay may face prolonged downtime, data loss, and heightened fraud risks for students and staff.
Alcorn School District serves approximately 3,800 students across three high schools, two middle schools, three elementary schools, a vocational school, and an alternative school, covering the towns of Farmington, Kossuth, Glen, and Rienzi in northern Mississippi. The district’s March 1 announcement noted that the network outage could impact scheduled testing. As of now, no further updates have been provided.
Alcorn School District cybersecurity rating report: https://www.rankiteo.com/company/alcornschools
"id": "ALC1773239671",
"linkid": "alcornschools",
"type": "Ransomware",
"date": "3/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': '3,800 students and staff',
'industry': 'Education',
'location': 'Farmington, Kossuth, Glen, Rienzi, '
'Mississippi, USA',
'name': 'Alcorn School District',
'size': '3,800 students',
'type': 'Educational Institution'}],
'customer_advisories': 'Public announcement on March 1 regarding network '
'outage and potential impact on scheduled testing',
'date_detected': '2024-03-01',
'date_publicly_disclosed': '2024-03-01',
'description': 'The Russia-based ransomware gang LockBit has taken '
'responsibility for a cyberattack on Alcorn School District in '
'Mississippi, which disrupted the district’s network earlier '
'this month. The district disabled its systems after detecting '
'suspicious activity on March 1. LockBit claimed the attack on '
'its data leak site, demanding an undisclosed ransom within '
'two weeks.',
'impact': {'identity_theft_risk': 'Heightened fraud risks for students and '
'staff',
'operational_impact': 'Disrupted operations, potential impact on '
'scheduled testing',
'systems_affected': 'District network, attendance tracking, '
'grading systems, communications, payroll, '
'student assignments'},
'investigation_status': 'Ongoing',
'motivation': 'Financial gain',
'ransomware': {'data_encryption': True,
'data_exfiltration': True,
'ransom_demanded': 'Undisclosed',
'ransomware_strain': 'LockBit'},
'references': [{'source': 'LockBit data leak site'}],
'response': {'communication_strategy': 'Public announcement on March 1',
'containment_measures': 'Disabled systems'},
'threat_actor': 'LockBit',
'title': 'LockBit Ransomware Attack on Alcorn School District',
'type': 'Ransomware'}