Bonneville Joint School District 93
Bonneville School District 93 cyberattack
Summary
Bonneville Joint School District 93 shut down its network after detecting a cyberattack June 19, 2025. Phones, internet and online summer instruction were disrupted. Network operations were later restored; the exact recovery date is unverified.
Key facts
Timeline
-
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Unauthorized access
Unauthorized access to systems, accounts, networks, or data.
Data impacts
-
Data unavailable
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Operational impacts
-
Network outage
Internal or external network connectivity was unavailable or materially impaired.
-
Internet access disruption
The organization lost or materially restricted internet connectivity.
-
Email disruption
Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.
-
Phone service disruption
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Educational operations disrupted
Instruction, student services, school administration, learning platforms, transportation, or other educational operations were materially affected.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
Bonneville Joint School District 93 shut down its network after its cybersecurity provider detected an intrusion on June 19, 2025. Our reporting documented the resulting interruption. The superintendent’s account to East Idaho News establishes the Thursday detection and same-day shutdown; it does not establish when unauthorized access began.
Operational significance
The protective shutdown disabled phones and internet access across district schools and offices. KIFI’s report relayed the district’s notice that staff access to email, Google Workspace and student information systems could also be limited.
Summer instruction was affected unevenly. Online credit-recovery and dual-credit courses depended on the unavailable network. In-person special education continued, with connectivity limitations for teachers. Lincoln High School adjusted grading for its final summer block. The superintendent’s projected two-week online pause was an estimate, not a verified outage duration.
KIFI subsequently reported that the network was fully operational following a district announcement on a Wednesday afternoon. That supports a resolved operational status. The original dated recovery announcement was not available in the reviewed evidence, leaving the exact restoration date and the timing of each summer program’s return uncertain.
Confidence and uncertainty
Confidence in cyber involvement and operational disruption is high because the superintendent and district statements directly described the intrusion, containment and service effects. Public disclosure on June 23 is distinct from the earlier detection and shutdown.
The superintendent said no information had been taken or lost and credited rapid containment. That is an attributed initial assessment; the reviewed reporting does not supply an independent forensic account. No ransomware mechanism, perpetrator or extortion demand has been established.
Analytic gaps
The entry method, intrusion duration, full technical findings and precise recovery chronology remain unknown. The provider was preparing an FBI report; this does not establish that the FBI opened an investigation. The earlier PowerSchool breach is a separate event and does not establish data theft in this attack.
The affected district includes parts of eastern Idaho Falls and surrounding communities. Network-wide containment interrupted district services, while the documented teaching effects concern summer programs. A districtwide shutdown does not establish that every student was attending classes or experienced the same interruption.
Organizations involved
Impacted locations
Bonneville Joint School District 93, Idaho
The protective shutdown affected network, phone and internet services throughout district buildings. The district area represents its public education remit; reported instructional consequences concern summer programs.
Idaho Falls, Idaho
District facilities and programs in the Idaho Falls area depended on the network taken offline.
Sources
Our reporting documents the district network and phone shutdown and summer-school disruption.
Reports all-school phone and internet shutdown, limited internal access, and a subsequent district announcement of restored network operations.
Superintendent confirms security-triggered shutdown and summer-school effects; says no information was taken or lost.
See something that needs correction?
Signed-in members can report an error, update, or missing source.