An intrusion detected around April 30, 2025, at Kalamazoo Public Schools disrupted internet, email and computer access and prompted canceled middle school conferences. Interlock later claimed the district, while a July notice described possible file copying; the exact recovery date and full data impact remain unresolved.
Unauthorized access to systems, accounts, networks, or data.
The incident is cyber-related, but available evidence does not establish whether or how data was affected.
A service, system, platform, or operational capability remained available only in part or with significant limitations.
The organization lost or materially restricted internet connectivity.
Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.
Internal business, administrative, operational, or staff-facing systems were unavailable.
Instruction, student services, school administration, learning platforms, transportation, or other educational operations were materially affected.
Scheduled events, meetings, hearings, classes, procedures, programs, or other activities were canceled.
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
An intrusion detected around April 30, 2025, at Kalamazoo Public Schools in Michigan disrupted district internet, email and computer access. The district’s initial public notice confirmed the outage and canceled middle school conferences while keeping buildings open. In a May 1 report, Superintendent Darrin Slade identified a network security incident and said systems would remain offline until they could be returned safely.
The district’s July 8 notification letter subsequently confirmed unauthorized network access and said files may have been copied. The direct district statements and contemporaneous operational reporting support a confirmed cyber assessment with high confidence. April 30 is the known detection date; the evidence does not establish an earlier intrusion start.
The initial notice said computers and email were affected but phones were not. It anticipated continued disruption through May 1 and announced that middle school conferences were canceled. It also described a half day for middle school students, without establishing whether that schedule was itself changed because of the incident. The evidence supports disrupted educational communications and computer-dependent work, rather than a districtwide school closure.
Our May 6 reporting described continuing offline systems and restrictions on staff device and account use. Slade said outside information-technology specialists were investigating and assisting recovery. The district’s education territory and its Kalamazoo administrative office provide geographic context; they do not establish uniform impact at every campus or property.
An Interlock-branded victim listing identified the district and its domain. The tracker record was discovered May 23, and TechNadu reported the allegation May 24. The listing supports recording an extortion claim, with low confidence in Interlock’s responsibility. It does not independently establish encryption, a particular intrusion method, the amount of data taken or a ransom payment.
The July letter said a file review identified potentially affected personal information June 16. The public Massachusetts copy redacts the specific data categories and does not supply a districtwide notification count. Its wording that files may have been copied is qualified; the record does not establish confirmed theft or publication of all student information.
The reviewed evidence does not establish the exact restoration day, full technical scope, entry route or ransomware family. The operational status is presumed resolved because the documented disruption is historical and follow-up research did not establish continuing impact. That assessment does not amount to a verified all-clear. The later claim and notification do not independently extend the outage.
The April network intrusion is distinct from the separate PowerSchool breach disclosed to district families earlier in 2025. Reporting that discusses both events does not establish a shared intruder or cause. The district’s statement that it had no reason to believe it was specifically targeted does not identify the attack mechanism or rule out opportunistic intrusion.
An Interlock-branded listing identifies Kalamazoo Public School District and its domain. The tracker discovered it May 23, 2025, and TechNadu reported the claim May 24. Confidence in responsibility is low: the district confirmed unauthorized access and possible file copying but did not identify Interlock, encryption or a ransom demand. The original posting and attack dates are not established. The separate PowerSchool breach is not attributed to this claim.
Supported education service territory of the affected school district. The overlay locates its geographic remit; it does not establish uniform impact at every campus or property.
Administrative office at 1220 Howard Street is physically in Kalamazoo city, confirmed by the district, NCES and exact Census address match. This is the affected district’s physical anchor, without asserting separately verified damage to the premises.
We reported continuing disruption to district systems, internet and email after the April 30 incident, with restrictions on staff device and account use.
The district confirmed an internet outage affecting computers and email, with phones unaffected. Buildings would remain open May 1, and middle school conferences were canceled.
Spokeswoman Susan Coney confirmed districtwide internet trouble and inability to access staff email and some other computer services, while classes were expected to continue.
Superintendent Darrin Slade identified a network security incident, said systems would remain offline until safe and described an investigation with a third-party IT firm.
The report attributed a victim claim concerning Kalamazoo Public Schools to Interlock. The district had not provided a response to the outlet’s inquiry at publication.
Kalamazoo detected unauthorized network access around April 30. It said files may have been copied and that a June 16 review identified personal information within those files.
The tracker lists Kalamazoo Public School District, its domain and Interlock, with a discovery timestamp of May 23, 2025.
Signed-in members can report an error, update, or missing source.
