Edwardsburg Public Schools cyberattack

Analyst assessment

Edwardsburg Public Schools in Michigan shut down its network and closed school buildings on Sept. 30, 2024, following a cyber incident. The district’s Sept. 29 public announcement identified a network outage. A later district-authored breach notice confirmed unauthorized access on or around Sept. 30 and removal of personal information. Ransomware and responsibility for the incident remain unresolved.

Operational significance

The closure interrupted instruction and canceled Camp Fire before- and after-school care. Instructional staff were asked to report at 9 a.m. Specified transportation to outside education programs, athletic events and extracurricular activities were to continue. Those exceptions limit the scope of the shutdown.

The superintendent’s letter, reported Oct. 10, described work with outside IT specialists. Students returned Oct. 1 after essential communications were restored. Phones and staff email were functioning, and the letter also reported internet access available to students and staff. Remaining work was acknowledged, alongside low-tech classroom activities. The letter’s send date was not established, and it does not provide an exact date when every network function was restored.

Data findings

The district’s notice said a comprehensive investigation and document review concluded July 21, 2025. It confirmed that full names and additional information identified in individual notices had been removed from the network. The published template leaves the additional fields blank. It does not establish encryption or name an attacker.

The Indiana attorney general’s report lists 6,978 affected people, including 879 Indiana residents, and July 28, 2025 notification. The Massachusetts filing lists seven Massachusetts residents and identifies Social Security numbers as breached information. These state counts are subsets, not additional national totals; the Massachusetts category findings do not establish the contents of every person’s notice.

The district said it knew of no resulting identity fraud or improper use at the time of its notice. The template offers monitoring but leaves its duration variable. Neither the review’s completion nor notification dates extend the operational outage into 2025.

Confidence and uncertainty

Comparitech and CYJAX discussed a Chort claim alongside Edwardsburg’s disruption. The tracker entry specifically names edwardsburgschoolsfoundation.org, which is the domain of a fundraising foundation supporting the schools. The district uses edwardsburgpublicschools.org. The reviewed evidence does not resolve whether the claim concerns the same compromised environment, so it does not establish Chort’s responsibility or a separately compromised foundation.

The tracker discovered that listing Nov. 17, 2024; this is not an established original posting or intrusion date. No verified ransom demand, payment or ransomware-encryption finding was identified. The district’s own notice independently confirms data removal regardless of that attribution uncertainty.

Analytic gaps

The initial access method, exact intrusion interval, complete affected-system inventory and final restoration date remain unverified. The notice’s approximate Sept. 30 access date is not treated as a precise start date.

Operational disruption is presumed resolved, with no exact end date assigned. Sept. 30 is the latest specifically dated service loss established in the reviewed evidence; the subsequent return and essential-service recovery are retained as bounded milestones. The public announcement and contemporaneous WNDU report establish that the closure was publicly reported at the time.