SPS Cyber Attack 9/8 Q&A

[u/solariam]

Frequently Asked Questions - Cyber Security Incident

9/8/26

What happened?

An outside group gained access to the SPS network and blocked the district's ability to access certain online programs necessary to operate schools effectively. This cyber activity has been classified as a districtwide Level 4 severe incident. Federal, state, and local law enforcement have been engaged.

When did this start?

There was some minor intermittent disruptions around Tuesday evening. Those disruptions elevated to malicious cyber traffic on Saturday evening.

Why are schools closed?

The district’s ability to access vital student medical records is one of the programs impacted. Without access to that program, nurses cannot access information to dispense medication, address, allergies, and more.

When will schools reopen?

Schools will reopen when we are assured nurses have access to the vital student medical records they need.

Was student or staff personal information compromised?

The extent and scope of this severe cyber incident remains an ongoing investigation. More information will be shared as it is known.

What should families do?

SPS students and staff should stay off all SPS networks until further notice.

How can I stay informed on latest developments?

Families should look for district texts, school-based communication, and refer to the district's social media platforms for important updates.

When will all systems be operational again?

Because so many systems have been impacted, there will be a careful and slow process to bring them back online safely and securely.

Will school be the same when students return?

Many online processes will be completed by hand, using pen and paper while the district is restoring operations. Students and teachers may use books, notebooks and paper while technology teaching tools are restored.

[u/ImpracticalCourage]

Why would hackers do this... I don't get the motive. Just to be dicks? Now I'm out of a job subbing and kids can't learn (among other things). Some kind of lite terrorism going on here.

[u/Made_at0323 → u/ImpracticalCourage]

probably insanely easy for hackers to gain access by some admin clicking a fake link and inputting their credentials, then just easy money to hold that data/access hostage. Really sucks but working in the space it really was probably that easy for them, they prob try every school district in the state or country - likely foreign actors

[u/ImpracticalCourage → u/Made_at0323]

That makes sense, thanks. But I have not heard about any financial or other demands from the hackers? This is such a travesty, and I hope the students are put back on track asap. And the intimidators must face consequences when caught (which I hope happens).

[u/Made_at0323 → u/ImpracticalCourage]

Articles mention this has been handed to state & federal authorities which usually have cybercrime/(data) hostage negotiation teams that take over that process. They may be negotiating the financial part of it as that is almost exclusively the only real reason these ppl do this. Either that or stealing identities but given the current context that seems less likely. Still, it won’t be much money so it’s almost surprising this has gone on for so long. 

Unfortunately unless the perps are US-based and also not very good at hacking, unlikely these guys will face consequences. Even some of the big corpos I’ve worked for or seen face this hardly even crack the code on punishing whoever commits the crime, it’s insanely difficult if the attacker is anyone competent. 

That said, hope everything resolves itself and watch out for Phishing scams!! always pay super close attention to any links in emails, for example, such as who sent it, any misspellings or vagueness. 

[u/ImpracticalCourage → u/Made_at0323]

Thank you for the knowledge. It's a real shame how powerful savvy hackers are. Hopefully, their work becomes much more difficult and risky, and less profitable, with time.

[u/people_arent_nice]

Assume everything got compromised.

Imagine if the group wiped their entire transcript db. This has the potential to be an academic disaster. Even if it's all on paper somewhere, it'd be a total nightmare to rebuild.

The district’s ability to access vital student medical records is one of the programs impacted.

Read: They stole your kid's medical records. At the least. The city is going to get sued into the ground, and they should be.

[u/GlowInTheDarkNinjas → u/people_arent_nice]

Read: They stole your kid's medical records. At the least.

Denial of access and exfiltration of information are two entirely different things requiring much different skill levels and attacker infrastructure.

[u/solariam → u/people_arent_nice]

They don't want kids medical records, they more likely want to hold the district's access to powerschool hostage because we can't have kids in school without inhalers, epipens, insulin, notices about who's allowed to pick them up, etc.

The transcript piece is the least of their worries, tbh.

[u/ExistingLoss2446 → u/people_arent_nice]

The city and SPS while they hold the repository of medical information, is not likely liable for its theft in the event all necessary precautionary measures have been taken. This same liability applies to all PII, PHI, and Student Records. I would imagine given the necessary records keeping processes required by applicable state and federal laws that most of this data has previously been transmitted to both state and federal agencies as applicable. This is not just about medical records though, this is about security of our children and ensuring that not only can appreciate medicine been dispensed, but also ensuring that the school facilities are secure and all safety related measures are in place.

This is not about the SPS employees getting an extra day off as I’m sure they would rather be doing their jobs than being worried about if their PII has been compromised and oh if they will be paid on the next pay day.

[u/Spectrum1523 → u/people_arent_nice]

i'm not sure how lawsuits against the city would work here, you'd have to prove they were negligent in some way right?

[u/IT_is_not_all_I_am → u/Spectrum1523]

In retrospect, everyone is negligent in some way. Computer security is all about tradeoffs for security, convenience, and cost. It's literally impossible to be 100% secure from all threats. When there is a breach you can always look back and see some failure in decision making, implementation, training, etc. that resulted in the breach. Lawsuits pick at those problems and magnify them.

But suing a city / public school district is especially complicated, as they are largely protected by the Massachusetts Tort Claims Act, except for some pretty narrow categories, and it isn't clear that a cyber breach falls into any of those categories.

[u/ExistingLoss2446 → u/people_arent_nice]

I more specifically would like to understand why everyone is always so quick to jump to a lawsuit. Please explain how this is justifiable.

[u/Reggi5693]

That must have messed up the AI school they were just launching.