Skip to content
DysruptionHub
Sign in Subscribe

Pelham School District

Summary

Pelham School District logo

A March 2025 cyber incident prompted Pelham School District in New Hampshire to disconnect its network, disrupting digital teaching and administration. Phones were restored by March 17 and internet and PowerSchool by April 2, while staff laptop rebuilding and report-card work continued.

Key facts

Timeline

  • Incident start:
    ? Earliest known or assessed start of malicious activity or incident activity.
  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted locations

Organization types

Critical infrastructure sector

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Presumed Resolved
Incident confidence:
High
Ransomware:
Unresolved

Attack mechanisms

  • Unknown cyber mechanism

    The incident is confirmed to be cyber-related, but the specific attack mechanism is unknown.

Data impacts

  • Data unavailable

    Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.

Operational impacts

  • Partial service outage

    A service, system, platform, or operational capability remained available only in part or with significant limitations.

  • Degraded service

    Services remained available but with reduced performance, reliability, functionality, capacity, or responsiveness.

  • Network outage

    Internal or external network connectivity was unavailable or materially impaired.

  • Internet access disruption

    The organization lost or materially restricted internet connectivity.

  • Email disruption

    Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.

  • Phone service disruption

    Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.

  • Internal systems unavailable

    Internal business, administrative, operational, or staff-facing systems were unavailable.

  • Transaction processing disruption

    Business, financial, customer, administrative, or operational transactions could not be completed normally.

  • Records processing disruption

    The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.

  • Educational operations disrupted

    Instruction, student services, school administration, learning platforms, transportation, or other educational operations were materially affected.

  • Service delay

    Services continued but with longer processing, response, delivery, or completion times.

  • Backlog created

    The disruption caused an accumulation of unprocessed requests, cases, orders, records, appointments, or other work.

  • Manual workaround required

    Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.

  • Alternate service channel required

    The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.

  • Staff unable to work normally

    Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.

Extortion indicators

  • No known extortion indicator

    Available evidence indicates that no extortion demand, threat, communication, or related pressure tactic was identified.

Incident narrative

Analyst assessment

A March 2025 cyber incident disrupted Pelham School District’s technology in New Hampshire. Superintendent Chip McGee told WMUR on March 14 that an employee’s computer trouble had alerted the district the previous morning. March 13 is therefore the earliest documented discovery, rather than a verified intrusion date.

The district’s March 19 board minutes explain that officials voluntarily disconnected internet access to secure the network and brought in an external cybersecurity specialist. This distinguishes the protective shutdown from an independently established attack mechanism. The investigation was still in its initial stages, and officials could not provide a definitive timeline.

Operational significance

The disruption affected internet access, phones, email and technology-dependent teaching. Classes continued using alternative materials. In its March 17 family update, the district described printed lessons, offline digital resources and previously downloaded materials. Teachers adjusted assignment deadlines, while report cards and special-education progress reports faced delays. School Messenger remained an update channel. Phones were already back in service, and safety systems had remained operational.

The April 2 board minutes describe disruption across all district buildings for approximately one and a half to two weeks. Internet and network services had been restored, and PowerSchool was again operational for students and parents. Report cards were due to follow. Staff were still using substitute Chromebooks while Windows laptops were reprocessed, with those working arrangements providing about 90% functionality. Business operations and payroll had continued without normal technology, and the state revenue department granted an extension for a budget report.

Confidence and uncertainty

Official district statements and board records support high confidence in a cyber incident with material educational and administrative disruption. They do not establish ransomware, encryption, data theft, a leak, an extortion demand or a perpetrator. Inability to use normal digital learning resources establishes an availability impact without establishing a confidentiality breach.

The incident is assessed as presumed resolved: core connectivity had returned by April 2, but endpoint rebuilding and reporting work remained. April 2 is the latest verified residual impact date in the reviewed evidence. The earlier two-week estimate does not establish March 26 as a precise recovery date, and no exact end date is assigned.

Analytic gaps

Public evidence reviewed does not establish initial access, the complete forensic findings, any personal-data consequences, or when all staff laptops and delayed reports returned to normal. Other school districts sharing the Pelham name are separate organizations.

Organizations involved

Impacted location

  • Pelham, New Hampshire

    Official current registration page https://www.pelhamsd.org/Registration1.aspx requires Pelham residency for district K–12 enrollment. Census TIGERweb unified school district3305550 and Pelham town3301159940 geometries are exactly identical, including455boundary edges, land68233745m² and water1394546m². School polygon: https://tigerweb.geo.census.gov/arcgis/rest/services/TIGERweb/School/MapServer/0/query?where=STATE%3D%2733%27%20AND%20NAME%20LIKE%20%27%25Pelham%25%27&outFields=&returnGeometry=true&outSR=4326&f=geojson Town polygon: https://tigerweb.geo.census.gov/arcgis/rest/services/TIGERweb/Places_CouSub_ConCity_SubMCD/MapServer/1/query?where=GEOID%3D%273301159940%27&outFields=&returnGeometry=true&outSR=4326&f=geojson Reuse existing town municipality as exact geographic service extent; no duplicate school-district location or municipal polygon borrowed for a distinct area. Paired organization service_area and incident impacted_area identify affected district remit, not every resident’s connectivity or municipal government compromise. Separate site-tier office anchor preserved; safety systems continued operating.

    Official district homepage and governance/registration pages place administration at59A Marsh Road, Pelham NH03076; exact Census street match confirms Pelham town county-subdivision GEOID3301159940, Hillsborough County33011. Use existing municipality as the physical office/school-community anchor; no facility location created. Original April2 minutes say services across district buildings were affected. Exact OSM relation306315 is administrative Pelham town; no loose coordinates/bounds supplied.

    Source

Sources

Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.