Springfield Public Schools in Massachusetts canceled classes through the weekend after an outside group got into the district's network, leaving more than 23,000 students home during the second week of the school year.
The district described it as a "Level 4" cybersecurity incident that "blocked the district's ability to access certain online programs." It has not publicly explained what that severity label means or which scale it comes from. Federal, state, and local law enforcement are investigating.
The trouble started Sept. 1, a week after the school year began, and escalated over the following weekend when, in the district's words, "an outside group gained access to the SPS network." Email, phones, and computers all went down.
The system that forced the closure, though, was the one holding student medical records. "Without access to that program, nurses cannot access information to dispense medication, address, allergies, and more," the district said.
A district can hold class without email. It cannot hold class if the nurse cannot confirm which second grader gets insulin at 11:30, which one carries an epinephrine injector, or which one cannot have peanuts in the room. Once those records moved off paper there is no filing cabinet to fall back on.
Superintendent Sonia Dinnall told reporters Wednesday that closing during the first weeks of school was not an easy call. "We have been very strategic, very intentional, collaborating with all of the partners that we brought on board to support us through this situation, and recommendations have come in from a variety of sources and experts and specialists and we've arrived to the conclusion that we need a little bit more time," she said. Dinnall said officials have not yet determined whether student or staff data was compromised.
The district this happened to
Springfield is the third-largest district in Massachusetts, running 65 schools with about 23,400 students, behind Boston at roughly 46,400 and Worcester at 24,800. Its students are 68% Hispanic, 18% Black, and 8% white. A lost week of school lands hardest on families with the fewest options for backup childcare.
Districts of this size are also the ones with the most attack surface and, often, the least security staff. A system with 65 buildings runs student information, payroll, transportation routing, food service, special education case management, and health records, often on separate vendor platforms bought at different times.
What the federal data says about what comes next
The Government Accountability Office, reviewing K-12 cyberattacks, found that "the loss of learning following a cyberattack ranged from 3 days to 3 weeks" and that "recovery time could take anywhere from 2 to 9 months." Districts reported monetary losses between $50,000 and $1 million per incident. The number of students affected by ransomware in schools climbed from about 39,000 in 2018 to roughly 1.2 million in 2020.
The Cybersecurity and Infrastructure Security Agency counted more than 1,300 disclosed school cybersecurity incidents between 2018 and 2021, and it has been explicit about why: criminals treat schools and districts as soft targets holding valuable records. Not every incident is disclosed, so those counts run low.
The three-day-to-three-week range is the number families in Springfield should watch. Closing until Monday puts the district at the optimistic end of it.
The reason districts hold this much data at all is the same reason they went paperless: a nurse checking allergies on a screen is faster and safer than one flipping through a binder, right up until the screen goes dark. Some districts have started pulling back on classroom technology for unrelated reasons, as one North Carolina district did with laptops, and advocates in Virginia have pushed for tighter rules on school-issued technology. Health records are a different category, and nobody is proposing a return to the binder.
What families can do right now is limited, which is its own frustration. Watch for a breach notification letter, which state law requires once a district confirms personal information was taken, and keep a written copy of your own child's medications and allergies in a bag they carry. That last one is worth doing whether or not your district has been attacked.
Sources
ABC News: Massachusetts school system cancels classes after Level 4 cyberattack
U.S. Government Accountability Office: As Cyberattacks Increase on K-12 Schools, Here Is What's Being Done
K-12 Dive: CISA issues K-12 cybersecurity guidance as schools' risks persist
Enrollment and demographic figures from allk12's analysis of National Center for Education Statistics (NCES) Common Core of Data.
