Evanston Township High School in Illinois closed June 8 and 9 after a ransomware attack disrupted district systems, internet service, phones and student resources.
The disruption affects students, families and staff during summer programming and has left parts of the school’s communications and online access unavailable. The District 202 campus in Evanston, just north of Chicago, serves students from Evanston and Skokie and enrolls about 3,600 students.
The district said the June 7 attack disrupted access to district systems, internet services and computer infrastructure. Summer school classes, sports camps and other on-campus activities were canceled during the two-day closure.
Reine Hanna, the district’s director of communications, told DysruptionHub the closure was necessary because the incident affected systems critical to safely operating campus, including network access, internet, phone service and other emergency or operational systems.
Phone systems were unavailable, staff had limited email access and families may not be able to access online tools, accounts or school resources, including Home Access Center, the district said.
The district said staff did not have access to district Google accounts or other network systems, including eSchool. It also said all staff Google passwords were reset as a security precaution, and most staff were told to work remotely unless otherwise instructed.
District officials said they activated incident response procedures, hired external cyber breach attorneys and cybersecurity forensic experts, and were working to determine what information may have been accessed or acquired. The district said it is cooperating with the FBI.
Hanna said the investigation remains ongoing and the district does not yet know the full scope of what data may have been affected. She said the district has not determined how the breach occurred.
The district has confirmed the incident was ransomware. Hanna said the district had not been made aware of specific demands associated with the attack.
Officials have not publicly identified a threat actor or confirmed data theft. DysruptionHub found no public claim of responsibility for the attack at the time of publication.
The Daily Northwestern reported that Superintendent Marcus Campbell notified students and families Sunday evening and said the attack affected district systems, internet services, computer infrastructure, phone systems, Google accounts and Home Access Center.
Chip in once
If this reporting helped you, a one-time tip helps cover hosting, tools and future investigations.
Support us monthly
A small monthly pledge keeps independent coverage and our reader tools online for everyone.
Illinois K-12 districts have seen several recent cyber disruptions since 2025, though the operational impact has varied.
Oakland Community Unit School District 5 said a holiday-break cyberattack was detected after unauthorized access and resolved before students and staff returned, with no reported school disruption. Zion Elementary District 6 closed schools and offices for several days after a cybersecurity incident, then reopened Dec. 4. Farrington District 99 in Bluford reported that a February ransomware attack had been contained before any information was compromised.
The district said it did not yet know when campus would reopen. Hanna said officials expect to make that decision within 24 hours, based on the investigation, system restoration and confirmation that ETHS can safely resume operations. Regular updates are expected on the district’s cybersecurity incident page.
