Skip to content
DysruptionHub
Sign in Subscribe

Rockford Public Schools ransomware attack

Summary

Rockford Public Schools logo

Ransomware disrupted computers, internet and phones across Rockford Public Schools in Michigan on May 15, 2024. Classes continued with books and paper, and most technology returned the next day; an INC Ransom-branded note claimed responsibility, which was not independently verified.

Key facts

Timeline

  • Incident start:
    ? Earliest known or assessed start of malicious activity or incident activity.
  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted locations

Organization types

Critical infrastructure sector

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Presumed Resolved
Incident confidence:
High
Ransomware:
Confirmed
Attribution:
Low

Attack mechanisms

  • Ransomware

    Malware that encrypts systems or data, typically accompanied by a ransom demand.

Data impacts

  • Unknown data impact

    The incident is cyber-related, but available evidence does not establish whether or how data was affected.

Operational impacts

Extortion indicators

  • Ransom demand

    The victim received a demand for payment in exchange for restoring access, decrypting systems, preventing disclosure, or stopping another threatened action.

  • Encryption-based extortion

    The extortion activity involved unauthorized encryption of systems or data, with restoration or decryption conditioned on payment.

  • Data-theft extortion

    The actor threatened to disclose, sell, distribute, or otherwise misuse stolen data unless the victim paid or complied with demands.

  • Public leak threat

    The actor explicitly threatened to publish or publicly release victim data or incident details.

  • Direct victim contact

    The actor directly contacted the victim through a ransom note, email, chat portal, telephone call, messaging platform, or other communication channel.

  • Operational disruption threat

    The actor threatened to continue, intensify, or renew service disruption or business interruption unless demands were met.

  • Negotiation portal or ransom chat

    A dedicated portal, chat system, or communication channel was used for ransom negotiation or victim instructions.

Incident narrative

Ransomware disrupted computers, internet access and landline phones across Rockford Public Schools in Michigan on May 15, 2024. Staff found printed ransom notes in several buildings, and the district disconnected systems during its response.

Analyst assessment

Original FOX 17 reporting quotes Superintendent Steve Matthews describing the technology interruption and the district’s work with law enforcement. WZZM’s reporting also identifies protective shutdowns, FBI involvement and an outside security firm. These accounts establish ransomware involvement and concrete educational technology effects.

Operational significance

Schools stayed open, with teachers and students using books, paper and pencils. Computers, internet and hardline phones were unavailable across district buildings. The superintendent said students were safe and security systems remained functional; the evidence does not establish a campus closure or failure of physical security.

A next-day FOX 17 follow-up says teachers could use most, if not all, usual devices and that the issue was isolated and contained. WZZM’s May 16 update separately reports phones working again. These are substantial recovery milestones, without a verified exact date when every affected function returned.

Confidence and uncertainty

Confidence in ransomware involvement and disruption is high. The ransom-note photo published by FOX 17 visibly uses INC Ransom branding. Contemporary Comparitech coverage likewise identifies that name from the letter. This supports a reported claim; the district’s statements do not independently verify the operator’s identity.

The note alleged theft and encryption, demanded payment and threatened disclosure. Those allegations do not establish the actual extent of data access, copying or encryption. Matthews told WZZM the district did not yet know what data might have been accessed.

The historical incident remains presumed resolved. May 15 is the latest definite observation of the broad technology outage, while May 16 marks substantial recovery. The exact end of every material effect remains unknown.

Analytic gaps

The initial access method, final forensic findings, independently verified actor attribution, any ransom payment and complete-restoration date remain unresolved.

Threat actor and claim

INC Ransom

View claim
Listed as: Rockford Public SchoolsSource: otherDiscovered:

Claim details

A printed note found in Rockford Public Schools buildings on May 15, 2024, uses INC Ransom branding in FOX 17’s publisher-censored photograph. It alleges theft and encryption, demands payment, threatens disclosure and another attack, and directs the victim to a negotiation chat. Comparitech’s May 17 report identifies the same branding. This supports a reported self-identification claim, rather than independently verified operator responsibility or actual data-theft scope. The original public posting time is unknown.

Organizations involved

Impacted locations

  • Kent County, Michigan

    The affected district’s offices at 350 North Main Street in Rockford are in Kent County. This identifies the physical county of the district’s base alongside its school-district service-area overlay, without asserting an outage across the county.

    Source

  • Rockford Public Schools, Michigan

    The school district’s own service area represents the educational reach of the affected organization. The superintendent reported computers, internet and hardline phones unavailable across district buildings while classes continued with books and paper.

    Source

  • Rockford, Michigan

    Rockford is the district’s administrative base. Local reporting identifies the Michigan district as the victim and describes technology and phone disruption across its buildings.

    Source

Sources

'Your data is stolen': Rockford schools hit by ransomware attack
FOX 17 West MichiganBy Daren Bower; Zac HarmonPublished: Retrieved:
  • Type: News Report
  • Platform: Website
  • Medium: Web Page
  • Confidence: High

District technology and phones were unavailable, while classes continued with books, paper and pencils.

The Week in Ransomware: May 17, 2024 — Rockford Public Schools
ComparitechBy Paul BischoffPublished: Retrieved:
  • Type: News Report
  • Platform: Website
  • Medium: Web Page
  • Confidence: Medium

The roundup identifies INC branding in Rockford’s printed letter, while the victim’s final data findings remained unresolved.

INC-branded ransom note photographed at Rockford schools
FOX 17 West MichiganBy Purported INC Ransom note, reproduced by FOX 17Retrieved:
  • Type: Threat Actor Source
  • Stance: Claim
  • Platform: Website
  • Medium: Image
  • Confidence: High

The printed note uses INC Ransom branding and demands payment while threatening disclosure and another attack.

Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.