Moscow School District 281
Moscow School District network intrusion
Summary
Moscow School District 281 said an intrusion into its internal network in early October 2025 disrupted some operations while classes continued. Superintendent Shawn Tiegs said the U.S. Department of Homeland Security was investigating. The method, data impact, ransomware involvement and precise restoration date were not disclosed.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Operational impacts
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
Incident narrative
Analyst assessment
Superintendent Shawn Tiegs said federal investigators were examining an intrusion into Moscow School District 281’s internal network during the week before Oct. 9, 2025. Operations were disrupted while restoration and forensic work continued. The Lewiston Tribune report was the article’s original source, but its page could not be independently rendered. The district did not publicly identify an entry method, data access or ransomware in the available account.
Operational significance
Classes continued while some internal operations were disrupted. The available accounts do not specify which technology services or individual buildings were affected. The district directory place its schools and administration in Moscow. The separate Census district boundary represents the education service area, not proof that every campus was compromised.
Current status and gaps
The October operational impact is confirmed by the superintendent’s reported account, but no exact restoration date or later district statement was located. Data exposure, ransomware and actor identity remain unverified. The January 2025 PowerSchool vendor breach mentioned in the article is separate from this October network intrusion.
Organizations involved
Impacted locations
Moscow School District 281, Idaho
Service area; not proof every campus system was compromised.
Moscow, Idaho
All listed district schools and administration are in Moscow.
Sources
Superintendent said DHS was investigating intrusion into district internal network in the previous week; operations disrupted, classes continued.
District superintendent reported internal-network intrusion and ongoing restoration.
Census school district Polygon covers a wider service area than the municipality.
District school list and office address are in Moscow, Idaho.
See something that needs correction?
Signed-in members can report an error, update, or missing source.