Springfield Public Schools cyberattack: Interlock ransomware, staff SSNs and student records taken

Date	Event	Record
About August 14, 2026	Attacker compromises an endpoint and gains access to the network	NH notice; sample letter
About September 4, 2026	Attacker attempts to download information from the servers	Sample letter
September 5, 2026 (Saturday)	District discovers its servers being encrypted	NH notice
September 15, 2026	FBI tells the district its data has been breached	District update, September 16
September 30, 2026	Report to Massachusetts (2026-1679): 10,000 residents	Massachusetts report
October 6, 2026	Letters mailed, including to 2 New Hampshire residents	NH notice
October 27, 2026	Update: SSNs of all current employees likely compromised	District update
Early November 2026	Letters due to former employees, volunteers and contractors	District update

What happened in the Springfield Public Schools cyberattack?

The account comes from the district's counsel, in a notice to New Hampshire's attorney general dated October 8, 2026. It says the attacker compromised an endpoint on or around August 14, used malware to move into the district's servers, and then activated ransomware at the start of a holiday weekend. Evidence shows files were taken from the servers before the encryption. The district rebuilt its servers, restored data from backups, hired forensic experts and reported to state and federal law enforcement.

The district's update page adds what came later. It says reports indicate a ransom was demanded but not paid, and that the investigation confirmed stolen district files were posted on the dark web. More than 20,000 staff and student computers are being reimaged. Schools remain open, and the district says recovery is not yet complete. The pattern, encryption plus theft and a leak posting, is the one described in the double extortion guide, which lists the groups CISA says use it.

What information was stolen?

The district's October 27 update lists the categories found so far: employee and student information, medical information or notes, telephone information, student disciplinary information, demographic information, lesson plans and test scores. The sample letter filed in New Hampshire tells recipients that their Social Security number, driver's license number or bank account information may have been reached.

The scope has grown twice. On September 16 the district said the FBI had told it the data was breached, that authorities had confirmed names, dates of birth and addresses were compromised, and that staff Social Security numbers might be. By October 27, investigators believed the Social Security numbers of all current employees were likely compromised, where earlier findings had pointed to some employees hired before 2008.

Who	What the district says
Current employees	Social Security numbers likely compromised for all; offered two years of IDX
Former employees (service to 2009 and earlier)	Records compromised; letters in early November
Volunteers (service to 2001 and earlier)	Records compromised; letters in early November
Independent contractors and vendors	Records compromised; letters in early November
Students	Disciplinary information, test scores and other records taken; no evidence of SSN exposure for most students

Were student Social Security numbers taken?

The district says it does not routinely store student Social Security numbers, and that the investigation so far shows no evidence they were compromised for the majority of students. Other student records were taken: the stolen files include disciplinary information and test scores. The school breach notices guide compares what other districts told families.

How many people were affected?

No total yet. Massachusetts lists 10,000 residents for the report filed on September 30, 2026, a round figure filed before the October finding that all current employees were likely affected. New Hampshire's notice covers 2 residents and says more may follow. Letters to former employees, volunteers and contractors were still going out in November.

I used to work or volunteer for the district. What should I do?

Watch for a letter from IDX. The district says former employees, volunteers and contractors in the affected groups should expect letters in early November if it has a current mailing address. If no letter comes, the district says it is building a way to update contact details and ask for a review, to be posted on its recovery page. Current employees who have not enrolled in the IDX protection are urged to do so. The credit monitoring guide explains what IDX offers include.

What the documents leave open

• The total number of people notified, across all states.
• How the first endpoint was compromised.
• The full list of what was posted on the leak site.