Bellflower Schools Detail August 2025 Network Incident; Rhysida Claim Unconfirmed
Summary
Bellflower Unified reported anomalous network activity and phone and internet disruptions in August 2025. The district restored services and said it had no indication sensitive data was accessed; a later Rhysida claim remains unconfirmed.
Key points
- Bellflower Unified said it detected anomalous network activity in early August 2025 and took some systems offline as a precaution.
- Phone and internet services were disrupted; by Aug. 11, the district said all sites had internet access and most functionality was restored.
- The district said it rebuilt a secure network, reset passwords, and made firewall, credential and other security-policy changes.
- Bellflower said it retained an independent forensic team, notified the FBI and the U.S. Department of Homeland Security, and found no evidence of further anomalous activity.
- The district said sensitive student, parent and employee data was stored in separate externally hosted systems and that it had no indication the data was accessed or acquired.
- In October, the district acknowledged an allegation that data had been removed while saying its assessment was ongoing.
- Leak-site trackers recorded a Rhysida claim against the district on Oct. 28; the claim was not confirmed by the district or law enforcement.
Article Details
- Victim Organization
- Bellflower Unified School District
- Incident Type
- Network security incident involving anomalous activity and service disruption; ransomware attribution is unconfirmed.
- Incident Date
- 2025-08-04
- Disclosure Date
- 2025-08-05
- Data Types Exposed
- Unspecified district data (the district reported an allegation that data had been removed; access or acquisition was not confirmed)
- Operational Impact
- Phone and internet services were disrupted beginning August 4, 2025. Certain systems were taken offline as a precaution, and on-premises servers were affected. The district reported that all sites had internet access again and most functionality had been restored by August 11; it later said operations had returned to full capacity.
- Ransom Or Extortion
- Leak-site trackers recorded a Rhysida claim against the district on October 28, 2025. The claim was unverified and not confirmed by the district or law enforcement. The district said on October 30 that it was aware of an allegation that district data had been removed; no ransom demand was reported.
- Claim Status
- claimed