Skip to content
DysruptionHub
Sign in Subscribe

Interboro School District cyberattack

Summary

Interboro School District logo

Network disruption forced Interboro schools to cancel classes Oct. 29, 2024. The district later confirmed files were copied during Oct. 13–28, exposing personal information. Ransomware reporting and RansomHub’s claim remain qualified.

Key facts

Timeline

  • Incident start:
    ? Earliest known or assessed start of malicious activity or incident activity.
  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted locations

Organization types

Critical infrastructure sector

DysruptionHub coverage

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Presumed Resolved
Incident confidence:
High
Ransomware:
Medium
Attribution:
Low

Attack mechanisms

  • Ransomware

    Malware that encrypts systems or data, typically accompanied by a ransom demand.

  • Unauthorized access

    Unauthorized access to systems, accounts, networks, or data.

Data impacts

  • Data theft or exfiltration

    Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.

Operational impacts

  • Network outage

    Internal or external network connectivity was unavailable or materially impaired.

  • Internet access disruption

    The organization lost or materially restricted internet connectivity.

  • Educational operations disrupted

    Instruction, student services, school administration, learning platforms, transportation, or other educational operations were materially affected.

  • Facility closure

    One or more offices, schools, clinics, stores, plants, branches, or other facilities closed because of the incident.

  • Event or activity cancellation

    Scheduled events, meetings, hearings, classes, procedures, programs, or other activities were canceled.

  • Staff unable to work normally

    Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.

Extortion indicators

  • Leak-site listing

    The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.

Incident narrative

School closure and network disruption

Interboro School District’s network problems prompted cancellation of classes Oct. 29, 2024. A message to families reproduced by DysruptionHub said networking issues continued across the district and teachers needed time to plan.

The message announced that school would resume Oct. 30 while warning that network problems could continue. Transportation for specified out-of-district placements and other activities was to continue. The reopening announcement was not an all-clear for the district’s technology.

CBS reported Nov. 7 that network problems continued and cited unnamed sources identifying ransomware.

District confirms files were copied

The district’s Notice of Data Event, marked released June 6, 2025, says an unauthorized person or people copied files from its systems between Oct. 13 and 28, 2024.

The district investigated, secured systems and reviewed the files to identify affected information, individuals and contact details. It said the event could involve past and present students, staff and employees.

Potential information varied by person and included names, Social Security numbers, driver’s license or state identification numbers, financial account information, account-access credentials and health insurance policy or subscriber numbers. The notice did not say that every category applied to every person.

The district reported no known actual or attempted identity theft or fraud at the time of the notice. It was working to notify affected people; the reviewed notice did not provide a total affected-person count.

Attribution and remaining uncertainty

A RansomHub listing for interborosd.org was discovered Nov. 19, 2024. That discovery is not a verified original posting or intrusion date. The claim does not independently establish the attacker’s identity.

The district’s copied-file finding confirms data theft independently of the listing. It does not confirm RansomHub attribution, a ransom payment or a particular initial-access method.

Current assessment

The incident is presumed resolved. The last directly documented continuing operational problems were reported Nov. 7, 2024, and an exact end to all disruption was not established. The later investigation and notifications do not extend the network outage.

Threat actor and claim

RansomHub

Listed as: interborosd.orgSource: ransomware.liveDiscovered:

Claim details

Ransomware.live records a RansomHub victim listing matching the district’s interborosd.org domain. The tracker discovered it Nov. 19, 2024; that timestamp is not an established original publication or intrusion date. The district’s original notice confirms unauthorized file copying between Oct. 13 and Oct. 28 but does not name RansomHub or confirm the group’s responsibility. Preserve this as an unconfirmed claim, separately from the district’s verified findings; the actor’s general techniques are not findings about this incident.

Organizations involved

Impacted locations

  • Glenolden, Pennsylvania

    Medium Confidence

    The district’s official website and company-authored data-event notice give 200 S. MacDade Blvd., Glenolden, PA 19036 as its administrative address. Preserve the supported Glenolden physical-place anchor. Three ordinary Census address variants returned no match, so no coordinate or exact municipal-boundary confirmation is asserted. This relationship does not establish a building-specific outage or define the district’s wider four-municipality service area.

    Source

  • Interboro School District, Pennsylvania

    Interboro School District’s territorial remit covers Glenolden, Norwood and Prospect Park boroughs and Tinicum Township, as described by Tinicum Township’s official schools page (https://www.tinicumtwpdelco.com/schools). Pennsylvania EdNA identifies the district and NCES ID4212170 (https://www.edna.pa.gov/Screens/wfInstitutionDetails.aspx?ID=26621). Exact current Census Unified School District Polygon4212170 differs from Glenolden4229720 and DelawareCounty42045. This is the public district’s service area, not a claim that every resident or campus lost all services. Schools-of-choice enrollment does not extend the boundary.

    Source

Sources

Interboro network-disruption report
CBS PhiladelphiaPublished: Retrieved:
  • Type: News Report
  • Stance: Report
  • Platform: Website
  • Medium: Web Page
  • Confidence: Medium

Continuing network trouble; ransomware reported.

Interboro School District: Notice of Data Event to the Public
Interboro School DistrictPublished: Retrieved:
  • Type: Official Statement
  • Stance: Confirm
  • Platform: Website
  • Medium: Document
  • Confidence: High

The district determined that an unauthorized person or people copied files between Oct. 13 and 28, 2024. Potential personal information varied by individual. It reported no known identity theft or fraud at the time of the notice.

Interboro School District news: Notice of Data Event
Interboro School DistrictPublished: Retrieved:
  • Type: Official Statement
  • Stance: Confirm
  • Platform: Website
  • Medium: Web Page
  • Confidence: High

The current district news post links the full Notice of Data Event concerning information about past and present students, staff and employees.

Interboro parent message: Oct. 29 closure and Oct. 30 reopening
Interboro School District (message reproduced by DysruptionHub)Retrieved:
  • Type: Operational Update
  • Stance: Report
  • Platform: Website
  • Medium: Document
  • Confidence: Medium

The district-attributed message canceled school for students in prekindergarten through grade 12 on Oct. 29, 2024, planned an Oct. 30 return and warned that networking issues could continue.

Ransomware.live listing: interborosd.org / RansomHub
Ransomware.liveRetrieved:
  • Type: Research Threat Intelligence
  • Stance: Report
  • Platform: Website
  • Medium: Web Page
  • Confidence: Medium

A RansomHub listing for interborosd.org was discovered Nov. 19, 2024, at 09:55:09.232270 UTC.

Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.