Cyberattack interrupts shared internet service for Nevada County schools

Analyst assessment

A cyberattack on Nevada Joint Union High School District disrupted a shared school internet network in October 2024. In the district’s Oct. 9 board meeting recording, Superintendent Dan Frisella described an attack the previous evening and said internet service was down. This establishes direct acknowledgment of cyber involvement and operational disruption; it does not establish ransomware encryption.

Operational significance

The district’s written meeting summary also documents the internet outage and an extended grading window. Teaching continued with offline activities, while staff used paper attendance sheets and other manual methods, according to The Union’s original reporting. The report identified effects at Nevada Union, Bear River, Ghidotti, North Point Academy and Silver Springs. Emergency notification and family communication systems remained available.

The Union also named five other districts that lost internet access supplied through the high school district: Grass Valley, Nevada City, Penn Valley Union Elementary, Twin Ridges Elementary and Clear Creek. These are downstream service effects, rather than evidence that each district suffered a separate intrusion. The named districts and schools provide a more precise scope than assuming every school in Nevada County was affected.

The scheduled Oct. 14–18 fall break was not a cyberattack closure. Forecasts that access might return soon also do not establish an actual restoration date.

Confidence and uncertainty

Confidence is high in the attack, interrupted connectivity and forced workarounds. In the recording, Frisella described insurer-supported assessment of the attack’s extent and data sensitivity, including how that assessment would inform possible negotiations. The local report separately described a ransom demand. Neither establishes a payment, a demand amount or encryption.

Frisella attributed entry to a compromised account in The Union’s reporting. He also described a British IP address while cautioning that apparent origin could be misleading. This does not identify the attacker or establish that the operator was in the United Kingdom. No named actor has been independently established.

Analytic gaps

The scope of access to sensitive information remained under investigation in the original reporting. A contemporaneous CBS Sacramento report attributed an assurance about student records to the superintendent; the overall data impact remained unresolved. The account-compromise method, any encryption, final data findings, costs and negotiations require further evidence.

The Oct. 9 recording places the attack the previous evening, while some reporting describes disruption beginning Wednesday. The latest reviewed account of ongoing effects is dated Oct. 11. The incident is presumed resolved because of the elapsed time since those effects, but full restoration and an exact end date have not been verified. Later document updates do not extend the outage.