Evanston Township High School ransomware closure

Analyst assessment

DysruptionHub assesses with high confidence that Evanston Township High School District 202 experienced a ransomware attack beginning June 7, 2026. The district’s rolling incident page confirms that the event disrupted district systems, internet services and computer infrastructure. DysruptionHub’s initial report and CBS News Chicago documented the immediate campus, communications and safety effects.

The district has not identified the access vector, ransomware family, compromised accounts, encryption scope or responsible actor. Ransomware is confirmed by the victim, but the technical and attribution picture remains limited.

Operational significance

The attack disrupted network connectivity, internet, phones, staff email and Google accounts, eSchool, Home Access Center, myETHS, door access, public-address functions and other emergency or operational systems. Because systems required for safe operations were unavailable, ETHS closed campus June 8–9 and canceled summer school, sports camps and other activities. Campus reopened June 10, but that did not mark full technology restoration.

In a July 16 school-year preparation statement, Superintendent Marcus Campbell said core servers had been inaccessible for about a month and that teams were rebuilding critical systems and restoring services. The district expected some tools, processes and timelines to function differently, with services returning in phases and temporary workarounds continuing into the school year.

The July 17 incident-page update said Home Access Center and myETHS were unavailable, full system restoration had no timetable, staff access remained limited and many district devices required review and reimaging before use. It also said the incident had interrupted transcript-data transfer, although the transcript issue was later corrected.

Current status

Recovery remained active at the July 26 cutoff. The district’s current student-parking page says the incident delayed the parking lottery, forced a temporary replacement process and left detailed account information unavailable online during a workflow with a July 26 deadline. This is direct current evidence of continuing records-access limitations and workarounds, supporting active status and a July 26 last-impact observation.

Confidence and uncertainty

Confidence is high that ransomware caused material educational and safety-related disruption because the district directly confirmed the attack type and affected systems. Data availability was affected because core servers, records portals and some information workflows were inaccessible. Whether personal information was accessed, copied or removed remains unresolved; the district said forensic specialists were still examining that question.

CBS reported that the district had not received a money demand at the time of initial reporting. No later demand, payment, leak-site listing, data publication or actor attribution was found, so extortion details and attribution remain unresolved.

Analytic gaps

The public record does not identify the access vector, ransomware family, dwell time, persistence, affected endpoints or servers, encryption scope, backup impact, ransom amount, payment status or responsible actor. It also does not establish whether student, employee or other sensitive information was acquired, the full recovery cost, or when every affected system and workflow will be restored.