SafePay Ransomware Breach Targets Gonzales Unified Schools
Ransomware Attack on Gonzales Unified School District by SafePay
Gonzales Unified School District (GUSD), a public school district in Gonzales, California, has allegedly fallen victim to a ransomware attack orchestrated by the SafePay group. The district, serving approximately 2,017 students across multiple schools, is recognized for its dedication to supporting a diverse student population, including a significant number of English Language Learners. Its focus on comprehensive educational programs and community engagement underscores its importance to the local community.
Attack Overview
The ransomware attack was identified on January 18, 2025, with SafePay claiming to have exfiltrated 40 GB of data from GUSD's network. The district's website, gonzalesusd.net, has not issued any public statements regarding the breach or its potential impact. The volume of data suggests a significant breach, potentially involving sensitive information related to students, staff, and district operations.
About Gonzales Unified School District
GUSD operates several educational institutions, including La Gloria Elementary School, Fairview Middle School, and Gonzales High School. Led by Interim Superintendent Dr. Deborah Blow, the district employs 283 staff members, including 114 teachers. With a student-to-teacher ratio of approximately 20:28, GUSD emphasizes quality education and support services, such as mental health resources and social-emotional support. The district's commitment to equity and comprehensive educational support distinguishes it in the education sector.
SafePay Ransomware Group
SafePay is a ransomware group known for its use of ransomware-as-a-service (RaaS) tactics and the LockBit source code. The group employs a double-extortion strategy, encrypting files and threatening to release stolen data if ransom demands are unmet. SafePay's operations are characterized by stealthy infiltration methods, often gaining access through valid credentials acquired via VPN gateways. Their dark web presence includes a Tor-based leak site where they list victims and details of stolen data.
Sources
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!