North Stonington Elementary School listed on interlock leak site

• Ransomware group: interlock
• Country: United States
• Sector: Education
• Announcement date: October 13, 2025

The threat actor known as interlock has listed North Stonington Elementary School on its leak site. The group claims to have obtained a massive dataset belonging to the institution, totaling over 3 TB of data.

The claimed attack and methodology

On October 13, 2025, the interlock group announced that it had listed data allegedly belonging to North Stonington Elementary School on its dedicated leak site. According to the claims made by the threat actor, the data was obtained by exploiting vulnerabilities within the institution's IT security infrastructure. This method of exploitation is a common tactic used by ransomware groups to gain unauthorized access to protected networks.

The announcement asserts that the breach resulted in the compromise of a comprehensive dataset. While the specific method of entry is attributed to infrastructure vulnerabilities, the scale of the claimed theft suggests a significant breach of the school's digital perimeter. It is important to note that the information regarding the specific identity and technical capabilities of the interlock group remains limited.

Data involved in the alleged breach

The information provided by the threat actor suggests that the compromised data is extensive. Based on the screenshots provided by the group, several folder names were identified, which indicate the nature of the stolen information. These folders include 'Students', 'Mail Databases', 'PST', and 'Users', suggesting that the breach may encompass student information, email correspondence, and various user-related data.

The specific types of data allegedly compromised include:

• Student records
• Email data
• Institutional documentation

The presence of these specific directories suggests that the breach extends beyond simple administrative files to include sensitive communications and personal identifiers.

Organization profile

North Stonington Elementary School is a public school located in the state of Connecticut, United States. As a public educational institution, it provides primary education services to students residing in the region.

Implications and organizational risks

This incident highlights the significant risks that educational institutions face regarding the privacy of sensitive data. The exposure of student-related information can create dangerous opportunities for malicious actors to conduct identity theft or launch social engineering attacks against students, staff, or parents. Such attacks often leverage the personal details found in school records to gain trust in subsequent fraudulent communications.

Furthermore, the leak of email databases can lead to the exposure of internal communications, which may facilitate secondary phishing attacks. When internal correspondence is made public, attackers can use the context of previous discussions to craft highly convincing fraudulent messages. Additionally, given the regulations regarding the protection of educational data in the United States, such as the Family Educational Rights and Privacy Act (FERPA), the institution may face legal and administrative consequences resulting from the exposure of protected information.

In general, ransomware groups often employ a strategy known as double extortion. In this scenario, attackers do not just encrypt an organization's files to demand a ransom for decryption; they also steal sensitive data and threaten to leak it on a public site if the ransom is not paid. This adds a layer of pressure on the victim, as the threat of a data leak remains even if the systems are successfully restored from backups. To defend against such threats, organizations typically focus on hardening their IT security infrastructure, implementing strict access controls, and maintaining robust monitoring to detect vulnerabilities before they can be exploited.