Attack alert: interlock targets Providence Academy - US

Introduction

On December 3, 2025, the Interlock ransomware group claimed responsibility for an attack against Providence Academy, a private Catholic school in the United States founded in 1969. This breach, classified as SIGNAL level according to our XC-Classify protocol, potentially exposes sensitive data belonging to students, families, and staff at this institution, which has between 100 and 250 employees. The incident occurs amid a surge in cyberattacks targeting the education sector in the United States, where schools are prime targets due to their often vulnerable infrastructure and the critical nature of the information they hold. This intrusion raises urgent questions about the protection of personal data in educational environments and the ability of institutions to withstand sophisticated cyber threats.

The attack against Providence Academy illustrates the growing threat that Interlock poses to American educational institutions, particularly those that manage large volumes of personal data belonging to students and families without necessarily having cybersecurity resources comparable to those of large corporations.

Analyse détaillée

#1. How Interlock Compromised Providence Academy, Education in the US

The Interlock malware targeted Providence Academy in early December 2025, compromising the computer systems of this private Catholic school in the United States. This cyberattack is part of a trend observed for several months: the intensification of ransomware attacks against the American education sector, where institutions accumulate technical vulnerabilities and highly sensitive data.

Providence Academy, which has welcomed hundreds of students since its founding in 1969, manages critical information daily: academic records, student medical data, family contact information, digital learning systems, and financial information. The compromise of these digital assets represents a major risk to the privacy of families and the continuity of educational activities.

The SIGNAL level assigned by our XC-Classify analysis indicates limited but concerning exposure, suggesting that the malware successfully infiltrated certain segments of the school's network. This classification, based on certified and verifiable data, allows for an objective assessment of the incident's severity without undue dramatization.

The attack occurred at a critical time in the school year, when schools were preparing for midterms and managing sensitive administrative processes. For Providence Academy, an organization employing between 100 and 250 people, the incident represents a considerable operational and reputational challenge, especially since family trust is a fundamental pillar for a private school.

2. Interlock: Modus Operandi, History, and Victims of the Ransomware Group

Interlock is a cybercriminal collective specializing in ransomware attacks, currently active and targeting various organizations worldwide. This group operates according to the classic double extortion model: encrypting the victim's data and threatening to publish the exfiltrated information if the ransom is not paid.

Interlock's modus operandi relies on a methodical, multi-phase approach. The malicious actor typically begins by identifying vulnerabilities in target systems, often through sophisticated phishing campaigns, the exploitation of unpatched software flaws, or the compromise of privileged accounts. Once initial access is gained, the group establishes persistence within the compromised network, moving laterally to map the infrastructure and identify the most valuable digital assets.

The exfiltration phase systematically precedes encryption. This strategy allows the cybercriminal collective to maintain maximum pressure on its victims: even if the organization has functional backups, the threat of public data disclosure provides a powerful extortion tool. The stolen information is then published on dedicated leak sites if negotiations fail.

Interlock opportunistically targets various sectors but shows a predilection for organizations with sensitive data and limited payment capabilities, such as educational institutions, local governments, or small and medium-sized enterprises. This strategy reflects a cynical calculation: these entities often possess less robust cybersecurity defenses than large corporations, while managing information whose disclosure would have serious consequences.

The group maintains an evolving technical infrastructure, regularly adapting its tools and techniques to circumvent detection solutions. This operational agility, combined with a deep understanding of organizational vulnerabilities, makes Interlock a persistent threat to organizations of all sizes, particularly those in the education sector, which face both budgetary constraints and the responsibility of protecting student data.

3. Providence Academy: Company Profile - Education (100-250 employees) - US

Providence Academy is a private Catholic school in the United States, founded in 1969, with over 55 years of history dedicated to education. Employing between 100 and 250 people, this institution embodies the traditional values of Catholic education while progressively integrating modern digital teaching tools.

The school welcomes students of varying academic levels and manages a complex information ecosystem on a daily basis. Digital learning systems enable personalized academic monitoring, communication with families, and the management of grades and assessments. These platforms contain detailed academic records, tracing each student's complete educational journey: academic results, assessment reports, and individualized education plans for students with special needs.

Beyond strictly academic data, Providence Academy holds sensitive family information: complete contact information for parents and legal guardians, financial information related to tuition fees, medical records necessary for student health management, and various parental authorizations. This wealth of information, essential to the operation of a modern school, paradoxically constitutes an attractive attack surface for malicious actors.

Providence Academy's position in the American educational landscape, despite being a medium-sized institution, confers upon it a particular responsibility toward the families who entrust their children to its care. The compromise of its systems represents not only a technical incident, but a potential breach of the fundamental bond of trust between the school and its community.

The institution operates within a strict regulatory environment, particularly regarding the protection of student data governed by U.S. federal and state laws. This attack therefore raises not only operational and reputational questions, but also legal and regulatory compliance issues for this institution, which must now manage the multidimensional consequences of this intrusion.

4. Technical Analysis: Level of Exposure

The XC-Classify analysis assigns a SIGNAL level to this compromise, indicating limited but nonetheless concerning exposure of Providence Academy's systems. This classification, based on a review of available certified data, suggests that the malicious actor managed to infiltrate certain segments of the network without necessarily compromising the entire IT infrastructure.

The SIGNAL level is positioned at the lower end of our criticality scale, but should not be interpreted as negligible. It typically indicates that an intrusion has been detected, that data has potentially been exfiltrated, but that the exact extent of the compromise remains to be determined or that the volume of exposed information is relatively limited compared to the total storage capacity of the targeted organization.

For an educational institution managing student and family data, even limited exposure can have significant consequences. The information typically held by Providence Academy includes complete academic records, sensitive medical data necessary for managing school health services, detailed family contact information, and financial information related to tuition fees.

Conclusion

The incident timeline begins with the discovery of the attack on December 3, 2025, although the initial attack vector and the exact duration of the malicious actor's presence on the network remain to be determined. This temporal uncertainty is common in cybersecurity incidents, where the attackers' time on the network often precedes the actual detection of the intrusion by several weeks or even months.