anwsd.org Listed by Threeam Ransomware Group

On January 7, 2025, the threeam Ransomware Group listed the Addison Northwest School District on its leak site, claiming that internal files had been exfiltrated from the Vermont district that serves Vergennes Union Elementary School, Ferrisburgh Central School, Addison Central School, and Vergennes Union High School.

What Public Reporting Shows

Public reporting indicates the district’s systems were compromised in a ransomware incident. The attackers published proof of access on their dark-web leak page, showing samples of internal documents. No exact victim count has been released, but the district operates four schools covering kindergarten through grade 12, meaning staff, students, and families in the Addison County area between Burlington and Middlebury are potentially affected. The data exposed consists of internal files rather than a single structured database; exact contents remain unclear from the initial posting.

Why This Matters for You and Your Family

When a school district is hit, the information stolen often includes names, addresses, dates of birth, student records, employee payroll data, and contact details for thousands of local families. If your child attends one of these Vermont schools or you work there, your family’s personal information may now sit on a criminal server. School breaches frequently lead to follow-on fraud because education systems hold the exact combination of identifiers—Social Security numbers for staff, medical notes for students, and family addresses—that identity thieves need. Even if you never entered your data directly, children’s records can link back to parents and siblings, pulling an entire household into risk.

The Doxxing and Identity-Chain Implications

Ransomware groups rarely stop at encryption. Once they have internal files, they map relationships between email addresses, usernames, phone numbers, and family members. A single leaked school document can connect a child’s gaming handle to a parent’s work email, creating an identity chain that stretches across social media, gaming platforms, and data-broker profiles. Public reporting describes how these chains enable doxxing, targeted phishing, and account takeovers. Credential leaks like this one routinely cascade into gaming account compromises because children often reuse passwords or security questions derived from school information. Protecting both adult and children’s accounts is therefore essential.