Campus Alert Archive
FVCC

Hackers Threatening to 'Splatter Kids' Blood' Shut FVCC for Five Days in Montana's First Major Cyber-Extortion Campus Closure

MTotheradvisorymedium confidence
Confirmed HoaxDetermined to be a hoax. The institutional response is documented because it reveals how the alert system performed under a perceived real threat.

Flathead Valley Community College in Kalispell, Montana, closed both its Kalispell and Lincoln County campuses on September 14, 2017, after the cyber-extortion group known as 'The Dark Overlord' hacked the Columbia Falls School District and sent terrorizing threat messages to students, families, and staff across the Flathead Valley. The hackers stole sensitive personal data from the district's servers and demanded up to $150,000 in Bitcoin to destroy the stolen files, warning that violence would follow if payment was refused. FVCC remained closed for five days alongside approximately 30 K-12 schools and re-opened Tuesday, September 19.

Alerts
3
Response
—
Killed
—
Injured
—
Institution
Flathead Valley Community College
Community College · MT
~2,400 students
Confirmed Timeline

Alert Sequence

3 messages in sequence

Some alert texts below are approximate reconstructions from news coverage, not confirmed verbatim transcripts. Reconstructed texts are shown in italic with a dashed border. Verified verbatim texts have a solid border and are marked accordingly.

INITIAL ALERTEmail
Approximate reconstruction432 chars
Due to threatening messages received in connection with an ongoing law enforcement investigation involving schools throughout Flathead County, Flathead Valley Community College will be closed today, Thursday, September 14, including the Kalispell and Lincoln County campuses. We are taking this action in an abundance of caution and are working closely with law enforcement. We will provide updates as information becomes available.

This text has been reconstructed from news coverage and may not reflect the exact original wording.

The closure announcement is confirmed by multiple outlets (Flathead Beacon, MTPR, 406mtsports.com); the exact wording of FVCC's closure notice is reconstructed, as the campus alert text was not published verbatim.
FVCC was the only post-secondary institution among approximately 30 schools closed; the decision mirrored the response of K-12 districts across Flathead County including Columbia Falls, Kalispell, Whitefish, Bigfork, and Evergreen.
UPDATEEmail
Approximate reconstruction396 chars
FVCC will remain closed Friday, September 15, while law enforcement continues to investigate the cyber threats affecting Flathead County schools. Flathead County Sheriff Chuck Curry has released a statement clarifying that the threats are part of a cyber-extortion scheme and do not represent a credible physical threat to students or staff. We will communicate when campuses are clear to reopen.

This text has been reconstructed from news coverage and may not reflect the exact original wording.

Sheriff Curry's public Facebook post of the ransom note on September 15 confirmed to the community that the threats were financial extortion, not a genuine school-violence plot; this distinction was central to the decision about when to reopen.
The cyber-extortion group, calling themselves 'The Dark Overlord,' had previously attacked healthcare companies and Netflix before targeting schools.
ALL CLEAREmail
Approximate reconstruction377 chars
FVCC will reopen Tuesday, September 19, for regular classes and operations. Law enforcement has confirmed the threats against Flathead County schools were part of a cyber-extortion scheme and are not credible physical threats. The safety of our students and employees remains our highest priority and we thank the community for their patience during this unprecedented closure.

This text has been reconstructed from news coverage and may not reflect the exact original wording.

The five-day closure (Thursday September 14 through Monday September 18, reopening Tuesday September 19) is confirmed by multiple sources including 406mtsports.com and the Flathead Beacon.
FVCC's closure represented a significant disruption for adult and workforce learners who could not easily absorb missed days unlike K-12 students; the decision illustrated how cyber threats to adjacent school districts can cascade to community colleges.
Context

Background

In mid-September 2017, a hacking group calling itself 'The Dark Overlord' infiltrated the Columbia Falls School District's servers in northwest Montana and stole sensitive personal data including names, addresses, and medical records of current and former students and staff. The group then sent terrorizing messages to families, including references to the Sandy Hook massacre and threats to 'splatter kids' blood in the hallways.' The Flathead County Sheriff, Columbia Falls Police, Kalispell Police, and the FBI launched a joint investigation into the cyber extortion scheme. Approximately 30 K-12 schools closed, and Flathead Valley Community College closed both its Kalispell and Lincoln County campuses on September 14, affecting an estimated 15,700 students across the valley. Flathead County Sheriff Chuck Curry publicly posted the redacted ransom note on Facebook to demonstrate to the community that the threats were financial extortion rather than an actual school-violence plot. The Dark Overlord had previously attacked healthcare companies and Netflix before targeting schools; the Department of Education subsequently issued a national warning to schools about hackers targeting educational institutions. All FVCC campuses reopened Tuesday, September 19, 2017.
Analysis

Key Findings

FVCC's five-day closure was driven not by a campus-specific incident but by cyber extortion against an adjacent K-12 district, illustrating regional spillover from school-district cyberattacks
The Dark Overlord group stole student and family personal data from Columbia Falls School District servers and demanded up to $150,000 in Bitcoin
Sheriff Curry's decision to publicly release the redacted ransom note on Facebook was a transparency move designed to reduce community panic by confirming the threats were financial extortion, not genuine school-violence
Outcome
No physical violence occurred. Law enforcement determined the threats were a cyber-extortion tactic, not credible physical threats. The suspect was believed to be of British origin residing in Europe and on an international watch list. FVCC and all affected schools reopened September 19, 2017. No ransom was paid by FVCC.
Provenance

Sources

  1. News
    Flathead Valley Schools to Remain Closed Friday Amid Threat Investigation
    flatheadbeacon.com
  2. News
    Ransom note released after cyber-threats to Montana schools from The Dark Overlord hackers
    cbsnews.com
  3. News
    FBI, Local Police Investigate Threats To Flathead County Schools
    mtpr.org
  4. News
    All Flathead County schools remain closed Friday after threat
    406mtsports.com
Tags
cyber-extortionransomwaredark-overlordcampus-closuremontanacommunity-collegefbicolumbia-fallsflathead-valleyHoax
Added May 2026Updated May 2026Via ingestion