Hudson School District cyber incident disrupts networks and records

Analyst assessment

Hudson School District in New Hampshire experienced unauthorized access to its internal information systems on June 12, 2024. Note 16 of its 2024 annual report describes temporary loss of access to critical databases and permanent loss of some financial data. Staff reconstructed information using backups and other records.

This is a confirmed cyber incident with operational and data-availability effects. The financial report establishes more than a precautionary shutdown, while leaving the initial-access method and attacker unidentified. Permanent data loss does not itself establish intentional destruction or encryption.

Operational significance

We reported on June 25, drawing on contemporaneous Union Leader reporting, that network and phone disruptions delayed final grades and report cards. The district’s financial report independently confirms database and financial-record problems affecting administrative work.

At the Aug. 5 school board meeting, the superintendent said recovery was continuing. The business administrator described working through affected data while closing the fiscal year and preparing for an audit. These findings do not establish that instruction stopped, schools closed or every system remained unavailable through August.

The annual report’s audit findings said cybersecurity-related data loss compounded accounting delays alongside staffing turnover and inadequate reconciliations. Cash accounts were unreconciled when audit fieldwork began in November 2024; reconciliation was completed in December, delaying the audit. The district agreed to corrective procedures.

At the Feb. 7, 2026, district meeting, school board Chair Maureen Dionne said the incident had prevented staff from retrieving encumbrances and invoices at the end of fiscal 2024. She said auditors recommended carrying that year’s fund balance into fiscal 2025, contributing to an unusually high balance alongside higher-than-forecast revenue.

An Aug. 7 elementary-school notice directed families to the parent portal for annual forms and anticipated later teacher assignments. It demonstrates expected routine portal use, rather than an incident-wide all-clear. The historical incident is presumed resolved; its exact full-restoration date remains unknown.

Confidence and uncertainty

Confidence is high in the unauthorized-access and financial-data findings because the district’s annual report explicitly documents them. June 12 is the incident date identified retrospectively, while June 25 is the first verified public reporting. The annual report also describes outside assistance, additional authentication, monitoring and staff training.

The Aug. 5 minutes record the superintendent’s statement that student and staff personal identification information had not been breached. In a February 2025 WMUR retrospective, Superintendent Dan Moulis described an attack involving the firewall and servers and repeated that finding. The personal-information statements do not negate the separately documented loss of financial records.

Analytic gaps

The evidence does not establish a ransomware operator, ransom demand, payment, data theft or public leak. It also does not resolve which specific systems remained impaired during the August recovery work. The later annual report is not evidence of a new 2025 attack or uninterrupted downtime until publication. Nashua’s ransomware incident and later PowerSchool notices are separate events.