Loading story…
A cyberattack forced Colorado’s Salida School District to shut down its network after the intrusion began at about 6:30 a.m. on June 29 and was detected roughly two hours later. The incident damaged locally stored files on some network-connected devices, disrupted central-office administrative operations, and left some files potentially unrecoverable.
The district took all systems offline and retained specialists to investigate the attack and restore services safely. Officials said they had no indication that data had been accessed or exfiltrated at the time of disclosure, but forensic work remained ongoing; the district had not identified the attacker, intrusion vector, initial access method, ransomware involvement, or an extortion demand.
See the actors and campaigns active against you right now.
2 events from the most recent confirmed update back to the earliest known activity.
In a July 2 notice, Salida School District said it had no apparent evidence that information had been accessed or extracted. Final forensic findings were still pending, and the district had not identified a threat actor, attack vector, ransomware, or extortion involvement.
Salida School District in Colorado detected a cyberattack about two hours after it began around 6:30 a.m., shut down its network and took systems offline. The incident damaged locally stored files, some of which may be unrecoverable, disrupted central-office administration, and prompted the district to engage incident-response specialists.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
4 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcedatabreaches.net
Open sourcedysruptionhub.com
Open sourcesalidaschools.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A breach tied to **PowerSchool**, a widely used K-12 software provider, exposed student and teacher information from school districts across the U.S., including New Jersey districts where officials said data on students and educators was stolen in a nationwide cyberattack. Reporting on the incident said the compromise affected records held by schools using the platform, raising concerns about the scale of exposure across the education sector and the security of sensitive K-12 data. Separately, **Spring Lake Park Schools** in Minnesota canceled classes and shut down technology systems after an outside actor gained unauthorized access to district networks in what officials described as a suspected ransomware incident. The disruption affected classes, child care, community education, and after-school programs, while the district worked with third-party cybersecurity experts, state law enforcement, and the **FBI** to contain the intrusion and restore operations; officials later said classes would resume and that they had no evidence at that point that personal information had been affected.
Jun 29, 2026
Educational institutions are increasingly targeted by cybercriminals, with ransomware attacks causing significant operational disruptions and data loss. In the United Kingdom, new figures from Ofqual reveal that while more teachers are receiving cybersecurity training, schools are taking longer to recover from cyber incidents. Only 55 percent of affected schools managed to recover immediately, a decline from the previous year, and 10 percent reported critical damage, nearly double the previous rate. The impact on students and staff is severe, with some schools losing coursework and lesson plans permanently, forcing teachers to recreate resources and disrupting classes for weeks. One unnamed academy trust experienced such extensive damage that staff across the organization had to rebuild schedules and resources from scratch. The human cost is substantial, as students’ academic progress is directly affected by the loss of critical educational materials. Ofqual has responded by urging schools to strengthen their cyber defenses, emphasizing the importance of regular data backups and robust malware protection. In the United States, the South Lyon Community School District was forced to shut down schools after a ransomware attack crippled phone systems and emergency response sub-systems. Although there is no evidence that student or faculty data was compromised in this incident, the attack severely disrupted normal operations and highlighted vulnerabilities in critical infrastructure. According to the Center for Internet Security, 82% of K-12 schools in the U.S. experienced a cyber incident between July 2023 and December 2024, underscoring the widespread nature of the threat. The South Lyon attack was attributed to a well-known ransomware group, though officials have not disclosed the group’s identity. The incident demonstrates that even with increased awareness and training, schools remain vulnerable to sophisticated attacks that can bypass existing defenses. Both UK and US authorities stress that the cost of prevention, including reliable backup and recovery strategies, is far less than the cost of responding to a successful attack. The growing frequency and severity of these incidents have prompted calls for greater investment in cybersecurity measures across the education sector. The loss of access to emergency systems, as seen in South Lyon, raises additional concerns about student safety during critical events. The trend of longer recovery times and more severe outcomes suggests that attackers are employing more destructive tactics, making it harder for schools to restore normal operations. The publication of sensitive data, as referenced in other UK incidents, further illustrates the risks to student privacy and institutional reputation. As schools continue to digitize their operations, the need for comprehensive cybersecurity strategies becomes increasingly urgent. The educational sector’s unique challenges, including limited budgets and legacy systems, make it a prime target for ransomware groups seeking to maximize disruption. Authorities recommend that schools prioritize regular backups, employee training, and incident response planning to mitigate the impact of future attacks. The ongoing wave of ransomware incidents serves as a stark reminder that educational institutions must remain vigilant and proactive in defending against evolving cyber threats.
Jun 29, 2026
Hackers accessed up to 16 years of Colorado public school student data during a June ransomware attack on the Colorado Department of Higher Education, exposing records tied to students and educators across the state. Reporting said the compromised information included sensitive education data held by the department, making the incident one of the more significant state education-sector breaches in Colorado. Colorado officials later faced scrutiny for failing to promptly disclose the breach, with reporting indicating the department did not notify affected people and the public as quickly as expected after discovering the intrusion. The delayed disclosure raised concerns about compliance with breach-notification obligations and about how state agencies communicate cyber incidents involving long-retained student records.
Jul 12, 2026