“Ransom note” released after cyber-threats to Montana schools

KALISPELL, Mont. -- Classes were scheduled to resume Tuesday in northwestern Montana's Flathead Valley after more than 30 public and private schools canceled classes last week because several schools received cyber-threats. More than 15,000 students stayed home because of the closures.

Flathead County Sheriff Chuck Curry said investigators told school administrators there was no indication the threats were being made from northwestern Montana.

On Monday, he took the unusual step of releasing a ransom letter sent to school officials from a hacker or group of hackers calling themselves The Dark Overlord.

"We feel this is important to allow our community to understand that the threats were not real, and were simply a tactic used by the cyber extortionists to facilitate their demand for money," Curry posted on the Facebook page for the sheriff's office.

Curry said the group is already the subject of active investigations within the U.S., but the threats are thought to be coming from abroad, reports CBS Missoula, Montana affiliate KPAX-TV. It's also believed that the same group was behind the recent hacks of Netflix, HBO and other businesses, the station says.  

The first threat was sent late Sept. 13 to Columbia Falls High School. Other schools then received similar threats.

Schools canceled classes on Thursday and Friday and postponed weekend extracurricular activities due to the threats.

Investigators believe the person hacked into the Columbia Falls school district computer and used information from it to send disturbing threats via text and email to students, families and staff on Saturday.

The Dark Overload has claimed responsibility for the Montana threats, attempting extortion and talking up the operation to journalists in online chats.

The Dark Overlord, which first emerged last year, has claimed responsibility for more than a dozen digital breaches and the sale of more than 1 million private records, according to a criminal complaint obtained by tech website Motherboard. The hacker or hackers, who were recently in touch with The Associated Press to boast about the Montana threats, routinely try to extort money from their victims via highly personalized threats.

Informational meetings for parents were held Monday and there will be a law enforcement presence at area schools "until we are able to apprehend the suspect or further discredit the threat," Curry said.

The suspect has taken extraordinary measures to conceal his or her identity and location, Curry has said.

Teachers returned to public schools on Monday.

Classes also resumed Monday for students at Flathead Valley Community College campuses in Kalispell and Libby.