Bellflower Unified School District Hit by Rhysida Ransomware Attack in August 2025 In August 2025, Bellflower Unified School District (BUSD) in Los Angeles County suffered a ransomware attack that disrupted network services and compromised sensitive data, including Social Security numbers. The district confirmed the breach in June 2026, notifying affected individuals via letters filed with the California attorney general. The cybercriminal group Rhysida claimed responsibility for the attack on October 28, 2025, demanding a 10 Bitcoin ransom (approximately $1.15 million). BUSD has not confirmed Rhysida’s involvement, and it remains unclear whether the district paid the ransom or how the attackers breached its systems. The incident affected historical student, parent, and employee data stored on an impacted server, though current student records in the Aeries system were unaffected. BUSD is offering free credit monitoring through Iris Identity Protection to breach victims, with a 90-day enrollment deadline from the notice date. ### Rhysida’s Growing Threat Rhysida, a ransomware-as-a-service (RaaS) group active since May 2023, operates by encrypting systems and extorting victims for both data deletion and decryption keys. In 2025, the group claimed 92 attacks, with 27 confirmed by targeted organizations. Around the same time as the BUSD incident, Rhysida also struck: - Collège Supérieur de Montréal (Canada, October 2025) – Demanded $430,000 - Yokosuka Gakuin Elementary School (Japan, December 2025) – Demanded $519,000 In 2026, Rhysida has already claimed 10 additional attacks, including confirmed breaches at German tech firm Elabs AG and Canadian manufacturer STELIA Aerospace. ### Ransomware’s Impact on Education The BUSD attack is part of a broader surge in ransomware targeting schools. In 2025, 56 confirmed attacks on U.S. educational institutions compromised over 4 million records. Other recent incidents include: - Nelson University – Notified 22,000 individuals of a May 2025 breach linked to the Qilin ransomware group. - Evanston Township High School District 202 (Illinois) – Still recovering from a June 2026 attack. Such attacks disrupt critical operations attendance tracking, grading, payroll, and communications while exposing students and staff to fraud risks. Schools that refuse ransom demands may face prolonged downtime and permanent data loss. BUSD serves nearly 10,000 students across 13 schools in Los Angeles County. The district has not provided further details on the attack’s origin or response.