FBI investigators have told Springfield Public Schools in Massachusetts that staff and student data stolen in the intrusion that shut the district down has been published, after a cyberattack discovered two weeks earlier left the schools without phones or email and cut access to curriculum material, bus routes and medical records. The intrusion forced classes to be cancelled for a week, and students returned a day before the FBI notification; the district says it is still working out exactly what was accessed and where it was posted. The extortion picture is unusually well documented because the attackers left it on the machines: a notice that appeared on staff and student computers over the Labor Day weekend carried the heading "Critical Alert Data Breach", told the user it needed leadership attention, and directed them to a Tor browser, saying the attackers had locked access to critical files with strong encryption, extracted personal, financial and operational information, and "created a time-sensitive situation where your data faces public exposure". Mayor Domenic Sarno, who chairs the school committee, has implied but not confirmed that a ransom has been demanded, saying "money goes to our kids, not these individuals"; state and local police and the FBI are investigating. The district says it does not typically request children's Social Security numbers but cannot yet say whether payroll records containing them for staff were taken, and has been expediting free credit monitoring for district employees. Two features carry beyond this case: the attackers' notice was served through the victim's own login screen, which reaches every user the district has without a single phishing email, and the theft was confirmed only after the extortion deadline mechanics began — the disclosure timeline was set by the attacker, not the district.

• Source article