Tri-City College Prep High School Listed by medusa Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target educational institutions across the United States, exploiting the sensitive personal and operational data these organizations hold and the limited resources many schools have for cybersecurity. In this environment, claims of data theft and extortion appear regularly on leak sites operated by established criminal groups, placing students, families, and staff at potential risk even when full details remain scarce.

On June 17, 2024, Tri-City College Prep High School in Prescott, Arizona, was listed by the medusa ransomware group. Public reporting indicates that internal files were exfiltrated in a ransomware attack, with the total volume of data claimed at 1.2 GB. The number of people affected is unknown, and independent confirmation of the full scope remains limited.

What happened

According to available public reporting, Tri-City College Prep High School was listed by the medusa ransomware group on June 17, 2024. The group claims that internal files were exfiltrated during a ransomware attack and that the volume of data involved totals 1.2 GB. No further details on the precise timing of the intrusion, the initial access method, or any ransom demand have been disclosed in the available facts. The number of individuals whose information may have been involved is listed as unknown. As with most such listings, the appearance on a leak site constitutes a claim by the threat actor rather than independently verified confirmation of every asserted detail.

Who is medusa?

Medusa is a well-documented ransomware operation that has been active for several years. The group typically follows a double-extortion model: it encrypts systems and simultaneously steals data, then threatens to publish the stolen material on a dedicated leak site if a ransom is not paid. Medusa has previously claimed responsibility for attacks against a range of organizations, including educational institutions, healthcare providers, and commercial entities. Its operators are known to post victim names, sample files, and countdown timers on their public site as pressure tactics. Public knowledge of the group’s methods is drawn from multiple independent security analyses and prior incident reports; however, any specific assertions medusa makes about an individual victim, including Tri-City College Prep High School, should be treated as unverified claims unless corroborated by the organization itself or by forensic investigation.

Who is Tri-City College Prep High School?

Tri-City College Prep High School is a grade 9–12 public charter high school located at 5522 Side Rd, Prescott, Arizona, 86301. Established in 1999, the school emphasizes academic preparation for college and serves students in the Prescott area. Public records indicate it employs approximately 24 staff members. Like other secondary schools, it maintains records necessary for student enrollment, academic progress, staff employment, and day-to-day operations. Educational institutions of this type routinely hold personally identifiable information, academic records, and internal administrative documents, making them attractive targets for ransomware groups seeking both financial leverage and sensitive data that can be used for further fraud or identity theft.

The information in question

The available facts state that internal files were exfiltrated in the ransomware attack and that the total volume of data leakage is reported as 1.2 GB. No more granular inventory of file types, databases, or specific categories of personal information has been publicly disclosed. Organizations of this kind typically store student names, contact details, academic transcripts, attendance records, staff personnel files, and various administrative documents. Because the exact contents of the 1.2 GB of material remain unconfirmed beyond the general description of “internal files,” it is not possible to state with certainty which specific data elements were taken. Readers should treat any more detailed claims circulating online as unverified unless corroborated by official school statements or law-enforcement notifications.

Why it matters

Even a relatively modest volume of internal files can contain information that creates lasting risk for students, parents, and employees. Exposure of personal identifiers can facilitate identity theft, phishing campaigns, or social-engineering attempts that continue long after the initial incident. For a small high school with limited staff, the operational disruption of a ransomware event can also interrupt instruction, delay administrative processes, and divert scarce resources toward recovery. Because the number of people affected is unknown and the precise data types are not fully detailed, individuals connected to the school cannot yet assess their personal exposure with certainty. The incident underscores the broader vulnerability of educational institutions, which often balance open community access with the need to protect sensitive records.

Were you affected?

If you are a current or former student, parent, guardian, or employee of Tri-City College Prep High School, monitor official communications from the school for any notification about the incident. Consider placing fraud alerts with the major credit bureaus, reviewing financial and academic accounts for unusual activity, and being cautious of unsolicited emails or calls that reference school-related information. You can also run a free exposure scan of your email address to check whether your information has already appeared in known breach data sets. Remain alert for further updates, as additional details may emerge once any investigation is complete.

AICompiled with AI assistance from public sources and published under our editorial standards.