Ransomware Group: NIGHTSPIRE

VICTIM NAME: North Kitsap School District

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the NIGHTSPIRE Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The ransomware leak page pertains to the North Kitsap School District in the United States, an educational institution that was targeted in the attack. The incident was discovered on May 9, 2025, and involved the exfiltration of approximately 20MB of data. The attack date is recorded as May 6, 2025. The threat actor group responsible is identified as “nightspire.” The leak includes details about the types of malware used, such as infostealers like Azorult, Lumma, RedLine, and Vidar, which are typically employed to gather stolen information. The breach affected 26 employees and impacted 43 third-party entities associated with the district.

The leak page contains evidence of compromised data, which could include sensitive or confidential information related to the school district’s operations. Although specific PII or sensitive records are not publicly displayed here, the page indicates that a significant amount of data has been exfiltrated. Screenshots or visual evidence are not provided on the visible leak page, but the listing confirms a substantial breach. The attacker’s campaign appears to involve multiple malware tools aimed at harvesting data from affected systems. The leak URL is publicly available, but no detailed download links or explicit content are shared in this overview. The incident is classified under the education sector, with a notable impact in the US.