Vermont School District Hit by Kairos Ransomware: A Plain-English Briefing
Slate Valley Unified School District is dealing with a Kairos ransomware incident that exposed teacher records and brought a ransom demand. What happened and what employers should note.
What happened
Vermont’s Slate Valley Unified School District discovered a ransomware attack on September 3, 2026, when teachers could not sign in to Microsoft Windows. Superintendent Brooke Olsen-Farrell told VTDigger the district lost internet and internal platforms such as PowerSchool for about a week before cybersecurity contractors helped restore service. The school board has denied making any ransom payment.
Who is demanding money
A group calling itself Kairos emailed members of the media claiming it holds personal information on more than 1,500 employees, including Social Security numbers and home addresses, and threatened to leak it. Olsen-Farrell called the message an extortion attempt. Similar messages under the name “Kairos Support Group” have gone to staff and community members, according to the Vermont Agency of Education, which urged people not to respond, click links, or share personal information.
Investigation and costs
The FBI’s Albany office confirmed it is assisting. Olsen-Farrell said the FBI advised against paying, and that the district is spending hundreds of thousands of dollars on outside firms to determine which teachers were affected and to handle notifications. She expects cybersecurity insurance to reimburse those costs. The exact ransom figure was not disclosed; she described it as hundreds of thousands of dollars.
Why it matters
School districts and small employers hold the same kinds of staff records criminals want. A week without email, grading, or Windows logins is an operations crisis even before the privacy fallout begins.
What this means for your company
- Protect HR files like financial data. Social Security numbers and home addresses need tight access control and encryption.
- Practice restoring identity and core apps. Know how long it would take to bring Microsoft sign-in and line-of-business systems back without paying anyone.
- Prep staff for follow-on phishing. After a breach, crooks often email employees posing as helpers. Tell people to forward suspicious messages to IT and not to engage.
Need help protecting employee records and building a restore plan? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
This briefing is based on VTDigger’s October 2 report on the Slate Valley ransomware incident.
About The Author
