Fall River Public Schools discovered unauthorized network access April 7, 2025, and later confirmed ransomware encryption. Recovery disrupted network-dependent school work before the superintendent reported restored internet, email, printers and Chromebooks by April 29. The district’s later summary placed initial indicators in late January; exact intrusion and restoration dates and the full data impact remain unknown.
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Unauthorized access to systems, accounts, networks, or data.
Data was rendered inaccessible through unauthorized encryption, including ransomware-related encryption.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Internal or external network connectivity was unavailable or materially impaired.
The organization lost or materially restricted internet connectivity.
Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.
Internal business, administrative, operational, or staff-facing systems were unavailable.
Instruction, student services, school administration, learning platforms, transportation, or other educational operations were materially affected.
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
The actor imposed a deadline or public countdown before increasing the demand, publishing data, deleting keys, or taking another threatened action.
A ransomware attack disrupted Fall River Public Schools’ technology systems in April 2025. The district’s initial April 7 statement acknowledged unauthorized access and an investigation. Mayor Paul Coogan confirmed ransomware April 17, and the district’s later public summary described encryption in early April. These accounts support high confidence in ransomware and material disruption.
The summary placed the earliest indicators of unauthorized activity in late January, followed by movement within the network, remote-access tools and data staging. The exact intrusion date is unknown. Staging does not establish completed data theft, and later security improvements do not establish the initial access method.
Containment and recovery interrupted network-dependent school work. The Herald News’ April 30 report attributes restored wireless internet, email, printers and student Chromebooks to the superintendent’s April 29 school meeting report. The district’s later summary also confirmed normal operations had resumed.
Accounts of testing effects differed. Early coverage described interruptions, while the later district summary said workarounds allowed MCAS, Seal of Biliteracy and SAT testing to proceed. These accounts do not support a blanket claim that testing was canceled or instruction stopped throughout the incident.
The evidence supports resolved operational status. Neither the date by which recovery was reported nor the ransomware tracker’s discovery date establishes the exact final restoration date, which remains unset. The documented victim is the school district; the sources do not establish a simultaneous outage across all Fall River municipal services.
Medusa listed the district as an alleged victim. A researcher-hosted image of the listing shows a countdown and $400,000 offers for data deletion or download. These are actor claims and prices, not verified theft, a payment or an established loss. The listing does not independently prove who encrypted the district’s systems.
The district’s initial statement reported no evidence of personal-data access or misuse. Its later summary said an information-impact review remained underway. The mayor’s April comments about potentially affected older human resources information were preliminary. No final affected-person count or completed notification finding has been verified in this review.
Insurance statements also differed: early coverage described an uninsured recovery burden, while the mayor subsequently said the district fell under city coverage. The reviewed material does not establish a final claim decision, insurer payment or total response cost.
The entry route, precise intrusion and restoration dates, complete information impact, actor identity, costs and payment outcome remain unresolved. April 7 is the documented discovery and public acknowledgment date; late-January log evidence does not justify inventing an exact onset day. Continued data review and later threat reporting do not establish a continuing operational outage.
Medusa listed Fall River Public Schools as an alleged victim. A Comparitech-hosted public image shows a countdown and $400,000 offers to delete or download data, plus $10,000 for an additional day. The image displays April 12, 2025, without a timezone; original publication remains unknown. The stable tracker discovered the listing April 13, 2025. These claims do not verify data theft, a payment, victim contact or Medusa’s responsibility for the confirmed ransomware attack.
The original district website and communications office identify central administration at 417 Rock St., Fall River. Census exact address match confirms Fall River city (2523000) and Bristol County (25005), at -71.151653047438, 41.70734179793. The city is a physical site anchor; no facility location is created. Official directory: https://www.fallriverschools.org/communications-office .
The original MassGIS public school district download identifies Fall River (0095/00950000) as MuniK12, grades PK–12, tuition N. MassGIS documents that these districts use selected municipal polygons. Reuse the existing Fall River city as the district’s geographic service remit, without a duplicate district polygon. This overlay describes school service coverage, not uniform citywide system failure. Authority: https://www.mass.gov/info-details/massgis-data-public-school-districts .
Signed-in members can report an error, update, or missing source.
