Provincetown IB Schools
Provincetown IB Schools cyberattack
Summary
A cyberattack disrupted Provincetown’s school network from Oct. 17 to 28, 2024. The town later notified people that files containing personal information were acquired without authorization.
Key facts
Timeline
-
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Unauthorized access
Unauthorized access to systems, accounts, networks, or data.
Data impacts
-
Unauthorized data access
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
-
Data theft or exfiltration
Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.
Operational impacts
-
Network outage
Internal or external network connectivity was unavailable or materially impaired.
-
Internet access disruption
The organization lost or materially restricted internet connectivity.
-
Internal systems unavailable
Internal business, administrative, operational, or staff-facing systems were unavailable.
-
Educational operations disrupted
Instruction, student services, school administration, learning platforms, transportation, or other educational operations were materially affected.
-
Staff unable to work normally
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
School network and device disruption
A cyberattack shut down the Provincetown school network from Oct. 17 to 28, 2024, The Provincetown Independent reported. Servers and Windows computers were affected, and staff and students lost internet access at school.
Superintendent Gerry Goyette said staff shut down the network after a teacher reported unusual computer behavior. Outside specialists examined the server, affected devices were wiped and planned server replacement was accelerated. Officials said student Chromebooks and cloud-based student and health-record systems were unaffected.
Personal information was acquired
A town notification dated Nov. 15, 2024 states that files on the school district’s network containing recipients’ names and Social Security numbers were acquired without authorization. The town offered two years of monitoring and identity protection.
That notice establishes data acquisition beyond the disruption. The reported protection of cloud systems did not mean that every file on the school network was unaffected.
The Massachusetts 2024 breach report lists 50 Massachusetts residents affected under report 2024-2050. It also identifies Social Security, financial-account and driver’s-license information as breached categories. The figure is a state-resident count, not a verified national total, and does not establish that every person had every category exposed.
Response and remaining uncertainty
The town’s 2024 annual report says its IT department contained a major school cybersecurity incident and separately records server and virtual-environment upgrades.
The reviewed original notices do not identify a named attacker, a ransom demand or payment, or a verified initial entry method. General discussion of phishing in news coverage does not establish how this attacker entered the network.
Organizations involved
Impacted location
Provincetown, Massachusetts
Official town School Department and elected School Committee pages establish the local public school district. Current Census School layer0 GEOID2509840 (Provincetown School District) and county-subdivision layer1 GEOID2500155500 (Provincetown town) have exactly equal full GeoJSON Polygon geometry and land/water areas. Reuse this existing town as the district service area; do not create a duplicate district location. This marks the affected district’s geographic remit and does not claim every resident or town function lost service.
Official school homepage https://www.provincetownschools.com/ and town School Department https://www.provincetown-ma.gov/264/School identify 12 Winslow St. Exact Census address match is inside Provincetown town GEOID2500155500, Barnstable County25001. This is the school organization’s physical office/school city; no individual building location is created. The original reporting documents unavailable school network/server/Windows and internet access, not a municipality-wide outage.
Sources
DysruptionHub reported a school-network shutdown from Oct. 17 to 28, 2024, device recovery and Nov. 19 notification letters.
The town notified recipients that files on its school district network containing their names and Social Security numbers were acquired without authorization. It offered two years of identity protection.
The school network was shut down from Oct. 17 to 28. Servers, Windows devices and school internet were affected; officials said student Chromebooks and cloud-based student and health systems were not affected.
Report 2024-2050 lists Town of Provincetown, MA, with 50 Massachusetts residents affected. The listed breached categories include Social Security numbers, financial-account information and driver’s-license information.
The town’s IT department reported containing a major cybersecurity incident at the school. Its school highlights also described server and virtual-environment upgrades.
See something that needs correction?
Signed-in members can report an error, update, or missing source.