Henry County Schools network shut down by BlackSuit ransomware attack

Henry County Schools, a public school district south of Atlanta, Georgia, discovered suspicious activity on its network during the first week of November 2023. The district restricted network access while it investigated, disrupting internet connectivity across its schools and administrative offices along with online classes and some phone service.

On November 9 the district told families that an unauthorized user had gained access to part of its network. Officials said the intrusion reached a file storage area holding mostly historical procedural documents, and that the student information system, human resources records and email were not compromised. Henry County Schools said it coordinated with the FBI, the Department of Homeland Security and the Georgia Emergency Management Agency.

Superintendent Mary Elizabeth Davis said the district would rebuild in stages, running phased password resets and reintroducing one application or service at a time over several weeks. Mobile hotspots were deployed to school offices so staff could keep check-in processes and email running, and grade reporting tools and student Chromebook access were back by late November.

On December 5 the BlackSuit ransomware group, widely described as a rebrand of the Royal operation, listed Henry County Schools on its extortion site. The district did not confirm the group's claim. Superintendent Davis had confirmed in a district update that the incident involved ransomware, and The Record reported on December 6 that Henry County Schools was still coordinating with those agencies.