Loading story…
Sumner County Schools in Middle Tennessee delayed the start of the academic year after officials discovered a data breach in the district’s computer network earlier in the week. The district revised its school calendar to give staff time to respond to the cybersecurity incident before students returned, making the disruption significant enough to affect normal operations across the school system.
Public reporting indicates only limited technical and operational details have been released so far. Officials have not publicly identified a threat actor, disclosed the intrusion method, or clarified the scope of any compromised data, leaving key questions about the breach unresolved while remediation and investigation continue.
See the actors and campaigns active against you right now.
2 events from the most recent confirmed update back to the earliest known activity.
After discovering the breach, the district revised its academic calendar and delayed the start of the school year so the cybersecurity issue could be addressed before students returned.
Sumner County school officials in Middle Tennessee discovered a data breach in the district's computer network earlier in the week. The available reporting does not identify the threat actor, intrusion method, or scope of compromised data.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A breach tied to **PowerSchool**, a widely used K-12 software provider, exposed student and teacher information from school districts across the U.S., including New Jersey districts where officials said data on students and educators was stolen in a nationwide cyberattack. Reporting on the incident said the compromise affected records held by schools using the platform, raising concerns about the scale of exposure across the education sector and the security of sensitive K-12 data. Separately, **Spring Lake Park Schools** in Minnesota canceled classes and shut down technology systems after an outside actor gained unauthorized access to district networks in what officials described as a suspected ransomware incident. The disruption affected classes, child care, community education, and after-school programs, while the district worked with third-party cybersecurity experts, state law enforcement, and the **FBI** to contain the intrusion and restore operations; officials later said classes would resume and that they had no evidence at that point that personal information had been affected.
Jun 29, 2026
Hackers accessed up to 16 years of Colorado public school student data during a June ransomware attack on the Colorado Department of Higher Education, exposing records tied to students and educators across the state. Reporting said the compromised information included sensitive education data held by the department, making the incident one of the more significant state education-sector breaches in Colorado. Colorado officials later faced scrutiny for failing to promptly disclose the breach, with reporting indicating the department did not notify affected people and the public as quickly as expected after discovering the intrusion. The delayed disclosure raised concerns about compliance with breach-notification obligations and about how state agencies communicate cyber incidents involving long-retained student records.
Jul 12, 2026
A cyberattack forced Colorado’s Salida School District to shut down its network after the intrusion began at about 6:30 a.m. on June 29 and was detected roughly two hours later. The incident damaged locally stored files on some network-connected devices, disrupted central-office administrative operations, and left some files potentially unrecoverable. The district took all systems offline and retained specialists to investigate the attack and restore services safely. Officials said they had no indication that data had been accessed or exfiltrated at the time of disclosure, but forensic work remained ongoing; the district had not identified the attacker, intrusion vector, initial access method, ransomware involvement, or an extortion demand.
Sep 10, 2026