UPDATE: Springfield Public Schools announced Wednesday evening that school will be closed to students on both Thursday and Friday, with Monday, Sept. 14, slated to be the day classes resume.
—
One of the largest school districts in New England was closed to students yet again Wednesday as it deals with the fallout of a cyber breach.
As experts tell WAMC , incidents like it are becoming more frequent.
—
Despite the digital chaos for Springfield Public Schools, it was largely business as usual downtown Tuesday – the first of two days of school lost to a “cyber incident” that compromised the school district’s own networks.
As officials worked to resolve matters, residents came in and out of City Hall while some journeyed across Court Square during a fairly sunny day. Among them was local photographer Odelito Crespo, with his son, three-year-old Elijah, in tow.
All the while, Crespo’s 11-year-old daughter, Elena, slept in at home.
“Elijah's actually just starting Pre-K – he has not exactly started yet, but his sister is definitely not in school today, so … she's missing out,” he said as the two walked around Tower Square.
It was a decent day out, but as Crespo tells it, the school districtwide outage was on his mind, especially since Elena just entered sixth grade.
“She just started middle school… like, she's starting to get a feel for it, and getting all these days off kind of throws a lot of things off for her,” Crespo said, noting that his daughter attended the charter school Libertas Academy.
Libertas had opted to also close Tuesday, though it appeared to reopen Wednesday, while SPS classes remained shuttered. But, when the district might resume and if Monday’s first day of Pre-K would be affected were still open questions.
It’s a story playing out across the district – households trying to find ways to keep young ones busy or at least supervised while parents are at work.
The added pressure of Wednesday’s cancellation did not help as SPS continued to try and regain access to its own network – systems that contain vital student data like medical records.
As school officials explain, what started as minor disruptions a week ago turned into outright “malicious cyber traffic” by Saturday. Administrators were frozen out of the SPS network while phone services went dead, among other issues.
Progress is being made, officials say, though it’s not clear when classes will resume.
In fact, as Assistant Superintendent Terry Powe said Tuesday, there’s a chance that when class resumes, some SPS systems still won’t be in place. It means some classrooms that embraced student technology might have to recalibrate.
“I know when I was a child, we had books, we had paper, we had pencil - we have those same resources available now - books, papers, pencils, notebooks - all of those things are still in our school buildings, and teachers know how to use those tools, so that's what we intend to do, if necessary,” she said during a press conference. “We want to go back to paper and pencil, temporarily, until we can get our technology systems back up and running.”
None of it is a surprise to cybersecurity experts who spoke with WAMC this week. School districts remain a prime target for groups and individuals looking to take sensitive data hostage and either ransom it or hawk it to another party – or both.
According to a 2025 report published by the Center for Internet Security, a cybersecurity-focused non-profit based in the Albany area, 82 percent of K-12 organizations experienced “cyber threat impacts,” with “nearly 14,000 security events … observed, with 9,300 confirmed incidents.”
The report itself was based on an 18-month study between mid-2023 and the end of 2024.
WAMC notes that, as of Wednesday, SPS has not said whether or not student data or its systems were being held for ransom by hackers. They haven't publicly named the culprits, either, citing an active investigation.
Regardless, Brian Levine, an associate dean at the University of Massachusetts Amherst Manning College of Information and Computer Sciences, says the end result of the breach has been no less catastrophic.
“In any business or nonprofit or government agency, if you have to shut down and not provide the services you were intended for, that's really the worst case,” he said in a phone interview Wednesday. “I think often [about how] people say ‘It doesn't matter who you are - if you're a business where you have to connect to the internet in order to do your business, you're going to get hacked.’ There's going to be some type of malware or extortion or ransomware or something destructive. The question is, how well do you respond?”
Levine, who is also director of the UMass Cybersecurity Institute, notes that while SPS is in the spotlight over the scale of the breach, it’s a situation more entities are at risk of than one might think – and is a stark reminder in more ways than one.
“I think this type of incident, because it's affecting parents, gets a lot of press. But, I think every business should expect this to happen, and thus, every customer…” he continued. “People should be careful about putting their information online - they should think hard about who they trust with their information and their credit cards, and they should think about how at-risk they are. We're a modern society where it's really impossible to escape using a phone or doing transactions online, but you have to start to get educated and think about what risks you're putting yourself up against.”
Echoing that was Theodore “TJ” Sayers, senior director of threat intelligence at the Center for Internet Security, who explained why school districts in particular are such large targets for hacks, breaches and ransomware.
“There's financial records, there's demographic information on students, there’s class schedules, there’s information on parents, there's addresses - it's pretty much a one-stop shop [for] a criminal or a nation state who may look to extort people in the future or leverage information against individuals,” Sayers explained.
Again, as the threat intelligence director also notes, it’s not clear what data, if any, has been seized out of Springfield.
Sayers also says that, given the anatomy of the current breach and what information is available – it appears SPS’s own response, so far, has not been off-the-mark.
“There's nothing particularly wrong that Springfield Public Schools has done. Obviously, this is a very common thing that we see with the K-12 sector and [the sector has] come under fire very, very significantly over the last couple of years, particularly from ransom-related groups,” he said, adding that “AI-enabled attacks and “frontier AI models” that are being introduced are opening up “a new level of scale and speed for these types of attacks.”
As for what happens next – experts say there’s too many uncertainties to say for sure.
Levine says it wouldn’t be surprising to see SPS take its time restoring systems and ensuring they are not compromised again. Sayers, meanwhile, recommends that, regardless of what SPS has or has not announced, district parents should consider freezing their children’s credit in the meantime – a free process that would ensure potential data thieves are not able to cash in right away.
For now, though, some parents in Springfield are making do while others try to find solutions with school suddenly off the table.
As Crespo tells WAMC, for those who have the means, it’s a chance for some additional family bonding time.
“I mean, do your best with finding coverage for your kids, and if not, just make the best out of it - it's a beautiful day, take your kids outside, enjoy the weather, go to the park - make it make it your best,” he said, a day before Wednesday’s cloudy weather moved in to the region
--
UPDATE: Since the original airing of this story, Springfield Public Schools has announced that school will be closed to students on both Thursday and Friday, with Monday, Sept. 14, slated to be the day classes resume.
