Evanston Township High School (ETHS) in Illinois canceled summer school classes, sports camps, and all on-campus activities after a ransomware attack disrupted critical district systems and forced the temporary closure of campus.
The district disclosed the incident on June 8, stating that a ransomware attack discovered on June 7 affected access to district systems, internet services, and computer infrastructure. School officials said the disruption impacted systems required to safely operate the campus, prompting the closure of all activities on June 8 and June 9.
Unlike many ransomware incidents that primarily affect administrative operations, ETHS said the attack impacted critical operational and emergency systems necessary for safe building operations.
Attack disrupted systems needed for campus operations
According to the district, the ransomware attack affected access to district technology resources, internet connectivity, and other core infrastructure. Families were warned that online services, school accounts, and educational resources could become unavailable during recovery efforts.
School officials also reported that district phone systems were rendered unavailable and that teachers and staff had only limited access to email while response efforts continued.
Following emergency restoration work, the district announced on June 8 that Summer School programs, sports camps, and other scheduled activities would resume on June 10.
ETHS stated that emergency and safety systems had been tested and restored to a level that allowed the campus to reopen safely, although phone service remained unavailable at the time of the update.
Forensics investigation underway
District officials said they immediately activated incident response procedures upon discovering the attack and engaged external cybersecurity forensic specialists and cyber breach counsel to assist with the investigation.
The district is currently working to determine what information, if any, may have been accessed or acquired during the incident. No details regarding potential data theft or the identity of the ransomware group have been released.
ETHS also confirmed it is cooperating with the Federal Bureau of Investigation as recovery and investigative efforts continue.
Schools continue to face ransomware pressure
Educational institutions remain frequent ransomware targets due to their reliance on interconnected administrative, instructional, and operational systems. Attacks occurring during summer programs can still cause significant disruption, particularly when emergency communications and building management systems are affected.
The incident follows a series of cybersecurity events affecting educational organizations across the United States. BreachNews previously reported on the widespread Canvas-related data exposure affecting schools nationwide and Instructure’s subsequent confirmation that it paid a ransom following the ShinyHunters breach.
Additional education sector coverage:
- Instructure Confirms Ransom Payment Following ShinyHunters Canvas Breach
- Canvas Breach Escalates as Schools Across U.S. Report Data Exposure
At the time of publication, ETHS had not disclosed whether any student, employee, or district data was compromised during the attack.
