The will air after a countdown clock on the Medusa cyber gang’s dark web leak site strikes zero at about 4 a.m. ET Friday. The leak site suggests the Minneapolis school district’s window to meet a $1 million ransom demand will then close and a trove of district data, which appears to include a significant volume of sensitive student and educator records, will become available online.

蜜桃影视鈥檚 earlier reporting documented that Medusa鈥檚 tactics, which included posting a since-removed video previewing what appeared to be the stolen documents in its possession, were more aggressive and more marketing-savvy than those generally seen in other school district cyber attacks. 

A preliminary review of the gang鈥檚 dark web leak site by 蜜桃影视 suggest the compromised files include a sizable volume of sensitive documents, including records related to student sexual violence allegations, district finances, student discipline, special education, civil rights investigations, student maltreatment and sex offender notifications.

The Minneapolis Public Schools, which came under fire for referring to the February breach as an 鈥渆ncryption event,鈥� has not released any additional information since a March 9 statement posted on its web site. In it, school leaders indicate they don鈥檛 intend to deal with Medusa to get their now-encrypted data back.

鈥淲e have taken a stance against these criminals and are restoring our systems without the need to cooperate with them. As our response continues, we continue to work with and align with the best practices provided by federal law enforcement.鈥�

Medusa is apparently a popular name among threat actors. The group that struck Minneapolis schools, according to , Bleeping Computer,  got its start in June 2021, but upped its profile this year by increasing its ransomware activity and launching its ‘Medusa Blog’ leak site to publish victims鈥� data.

A ransomware gang called Vice Society attempted to extort the Los Angeles Unified School District last year after it broke into the district鈥檚 computer network and made off with some 500 gigabytes of district files. When the district refused to pay an undisclosed ransom, Vice Society uploaded the records to its dark web leak site. 

District officials sought to downplay the attack鈥檚 effects on students. But an investigation by 蜜桃影视 found thousands of students鈥� comprehensive and highly sensitive mental health records had been exposed. The district then acknowledged Feb. 22 that some 2,000 student psychological assessments 鈥� including those of 60 current students 鈥� had been leaked.

Ever since the mass school shooting in May at a Uvalde, Texas elementary school, families nationwide have been on high alert about the very real concern of such attacks decimating communities. But as South Carolina parents converged on their children鈥檚 schools and educators released students early, police statewide reached the same conclusion: This time, there was no real threat.

Instead, officials said the calls appeared to be part of a nationwide 鈥渟watting鈥� hoax that鈥檚 played out at hundreds of K-12 schools in more than a dozen states since classes resumed this fall. Weeks earlier, dozens of schools in Minnesota, Virginia and Ohio became targets. Now, as the police connect the dots and report commonalities, experts with years of experience chasing down swatting perpetrators believe that many 鈥� if not most 鈥� of the recent incidents targeting U.S. schools are connected. After all, similar swatting sprees have been coordinated in shady internet outposts for years. 

鈥淚f they鈥檙e hitting 12 or 15 schools in a particular jurisdiction or a particular state all at once, that is absolutely a coordinated attack,鈥� said James Turgal, a former executive assistant director for the FBI Information and Technology Branch. Turgal is a 21-year veteran of the FBI, which is actively investigating the latest swatting attacks on schools. 

Given its size, he suspects the most recent surge at schools is likely being coordinated by a group of people including foreign actors and swat-for-hire cybercriminals who carry out hoax emergency calls for money. While he does not necessarily believe it鈥檚 a government-sponsored attempt to sow chaos on American soil, Turgal thinks U.S. teens may still be pulling the strings with low-level foreign actors.

鈥淪watting is not something a nation state is going to get involved in,鈥� said Turgal, now the vice president of cyber risk and strategy at Optiv Security. 鈥淭hese are smaller organizations that are trying to sell their services, not what I would call really sophisticated.鈥澛�

With the recent wave of swatting incidents targeting schools, news outlets have identified several commonalities across communities and states, including , state-by-state of hoax calls and similar , 

Such hallmarks are consistent in at least a half dozen states, , which noted that multiple local police officials had reportedly traced the calls back to Africa. 

In Minnesota, 17 false calls were placed by someone with a distinct accent using the same voice over IP technology, Drew Evans, superintendent of the state bureau of criminal apprehension, told Wired. 

鈥淭here鈥檚 a lot of different technology that could make it appear to be a single person,鈥� Evans said. 鈥淏ut all the indications we have are that it鈥檚 either one person or a single entity.鈥� 

Conceptually, swatting is straightforward and in many ways follows the bomb-threat playbook that鈥檚 pushed schools into lockdowns and panic for generations. Often using technology to mask their true identities and locations, threat actors call the police to report an emergency like an active shooting or a hostage situation with the goal of forcing tactical SWAT teams to descend on a target and cause panic. In several cases, these malicious false alarms have ended in death.

Fame, notoriety and callous oneupmanship has long motivated swatting attacks, which have their origins in the video gaming community. The slew of and in recent months is likely a motivating factor, Turgal said.

In previous swatting cases 鈥� , like Ashton Kutcher and Justin Bieber and 鈥� many of the perpetrators turned out to be kids. Other swatting attacks have been politically motivated, ranging from those on extremist Republican Rep. Marjorie Taylor Green to outspoken gun control advocate David Hogg, who survived the 2018 mass school shooting in Parkland, Florida. 

In the last eight years, Los Angeles Police Detective Edward Dorroh has worked on hundreds of swatting incidents 鈥�  that . Of those, roughly 90% were carried out by children and teens, he told 蜜桃影视. Dorroh, who is currently assigned to the FBI Joint Terrorism Task Force, is assisting in police investigations on the latest swatting incidents targeting schools. For that reason, Dorroh said he couldn鈥檛 comment on current cases, but discussed his deep experience with these shadowy crimes and how police confront them. 

Among the gaming community which latched onto the practice, Dorrah said the act is considered even more rewarding if they can get a heavily armed, tactical police response on camera as gamers livestream their gameplay on platforms like 鈥� a particular swatting attack 鈥渋n the category of 鈥榝or the LOLs,鈥� for the entertainment,鈥� Dorroh said. 

鈥淭hey鈥檙e looking for influence,鈥� he said. 鈥淭hey brag about it and they build up a reputation and then what happens is people start to hire them out to do swattings. That鈥檚 where a lot of your school stuff comes in.鈥�

Such paid swat-for-hire schemes, he said, aren鈥檛 relegated to the dark web; they鈥檙e openly promoted on the instant messaging platform popular among gamers and young people generally, with more than . 

In a statement, the South Carolina Law Enforcement Division said that while the recent emergency calls 鈥渁re believed to be a hoax,鈥� it has encouraged local law enforcement agencies 鈥渢o take any and all threats seriously鈥� while they partner with state and federal law enforcement agencies to investigate. 

The FBI has acknowledged in a statement to 蜜桃影视 and other media outlets that they鈥檙e probing the surge in incidents, but they鈥檝e provided little specific information. 

鈥淭he FBI takes swatting very seriously because it puts innocent people at risk,鈥� the bureau said in the statement. 鈥淲hile we have no information to indicate a specific and credible threat, we will continue to work with our local, state, and federal law enforcement partners to gather, share, and act upon threat information as it comes to our attention.鈥�

Swat for profit 

Law enforcement officials have been grappling with swatting attacks against schools for years. In 2015, sounded the alarm on swatting attacks against schools, shopping malls and private homes designed to capture national media attention, wage revenge on video game rivals or to make a profit.

鈥淚ncidents of swatting across the country are commonly linked, and investigations often lead to groups of malicious actors outside the U.S.,鈥� the New Jersey Cybersecurity and Communications Integration Cell noted in a bulletin. 鈥淭hese foreign actors are often contacted and paid to conduct the swatting act by a student of the targeted school.鈥� 

Amy Klinger, the co-founder and programs director of The Educator鈥檚 School Safety Network, has been tracking school threats and violence incidents for years to provide educators real-time information on emerging trends. Beginning in late August, data indicated the start of an unprecedented school swatting spike. Leaders at every school in the U.S., she said, should assume 鈥渁t least in the short term鈥� that their campus is likely to become the target of a false active-shooter report and they must be prepared for the call. 

鈥淚t is not necessarily within the control of the schools to prevent these events, because clearly they鈥檙e happening,鈥� Klinger said.鈥� But I do think it is within the control of the school to anticipate 鈥榃hat would we do if that happened to us?鈥� Being proactive is the responsibility of the school, especially knowing that these are happening at such a high level of frequency.鈥�

Even though the school shooting threats are false, it鈥檚 important that educators and police remain diligent in responding to active-shooter calls without overreacting, said Kenneth Trump, president of the Cleveland-based National School Safety and Security Services. While 鈥渒nee-jerk reactions鈥� like swift school closures can embolden threat actors to carry out additional attacks, he said, failure to react could get someone killed. When school officials receive an emergency call, he said they should 鈥渁ssess and then react, not react and then assess.鈥�

鈥淚t鈥檚 not a prank, it鈥檚 not a joke, it鈥檚 a cruel hoax and it鈥檚 really causing a lot of anxiety in communities, even more so post-Uvalde,鈥� said Trump, offering a stern message to whomever is targeting schools nationwide. 鈥淲hen law enforcement catches up with you, which they will, you鈥檙e facing some very serious consequences 鈥� stuff that鈥檚 going to stay with you for the rest of your life.鈥� 

Swatting presents real-world dangers

Dorroh, the LAPD detective, knows firsthand the fear that comes with reports of an active school shooting. Just last month, a school in suburban Los Angeles where his wife is a teacher was forced into lockdown when someone swatted a nearby high school. He said that knowledge of the national trend allowed him to offer a measured emotional response.

Aside from psychological harm, there haven鈥檛 been any reports of widespread injuries stemming from the school swatting surge. Last month in Georgia, a police officer and another driver were as the cops raced to the scene of a school that was targeted in a swatting attack. 

But several swatting incidents outside of schools have led to deaths, highlighting the dangers the hoax presents to educators and students. Of two high-profile swatting cases where people died, Dorroh helped investigate both. 

Last year, 20-year-old Shane Sonderman of rural Tennessee was after he helped carry out a swatting attack on a 60-year-old computer programmer who refused to give up the coveted Twitter handle 鈥淍Tennessee.鈥� When police officers surrounded his house, the father of three and grandfather of six suffered a fatal heart attack. Sonderman, who began swatting as a teenager, with others, including a minor in the United Kingdom, to wage the attack. Dorroh said that for Sonderman, swatting was his only social outlet. 

Another swatting attack, carried out by Tyler Barriss of Los Angeles, led to the fatal police shooting of an unsuspecting man in Wichita, Kansas. Dorroh said his first run-in with Barriss was during an earlier investigation into hoax bomb threats targeting schools 鈥� phone calls that were never recorded. In that earlier case, police were able to pin him down after he made a hoax call to a television station. 

Then, in 2017, Barriss called police and told them he was at a house in Wichita, where he shot his father and was holding his family hostage. Except it wasn鈥檛 his house 鈥� it was the home of an unsuspecting 28-year-old man who police said became confused when they arrived. Amid the commotion, an officer shot and killed him.

Barriss had carried out the attack on behalf of two video gamers who were in a feud after a 鈥淐all of Duty鈥� match ended in one鈥檚 defeat. One gamer used Twitter to recruit Barriss to carry out the attack on a second gamer 鈥� who provided Barriss with the Kansas address. All three were charged criminally, and in 2019 in prison. 

鈥淚 was charging people, depending on how much of a stranger they were to me, anywhere from $20 to $50 per swat,鈥� Barriss said in a recent episode of the Netflix documentary series Web of Make Believe: Death, Lies and the Internet. 鈥淏ut, quite frankly, I enjoyed the thrill of swatting, I just enjoyed doing it, having it appear on the news and bragging about it on Twitter.鈥� 

Between 2015 and 2017, Barriss had been connected to false calls in Ohio, Nevada, Illinois, Indiana, Virginia, Texas, Arizona, Massachusetts, Missouri, Maine, Pennsylvania, New Mexico, Indiana, Michigan, Florida, Connecticut and New York.

鈥淲hen we had the fatal swatting in Wichita, they thought [Barriss] might be a suspect so when we heard the audio recording it was like 鈥榊a, that鈥檚 him,鈥� right off the bat,鈥� Dorroh said. 鈥淚t was just the matter of finding him and getting him into custody.鈥�