Cyberattack disrupts Salida School District systems

Analyst assessment

DysruptionHub assesses with high confidence that a cyberattack disrupted Salida School District’s network beginning June 29, 2026. In a July 2 disclosure, the district said the attack began at approximately 6:30 a.m., was identified by 8:30 a.m. and prompted personnel to shut down all systems while specialists investigated and planned a safe restoration. The district’s direct characterization and documented effects support OC-OD. Ransomware, extortion and attribution remain unresolved.

Operational significance

Devices active on the network sustained damage to locally stored files. Some files could not be recovered, and Central Office workflows were affected during the disclosure week. Cloud-based systems remained functional. Staff were instructed not to power on district devices pending evaluation.

At the Sept. 15 board meeting, Superintendent David Blackburn said the attack delayed full implementation of building-automation systems, with about two more weeks of work anticipated, according to The Mountain Mail. The report’s separate HVAC and mold complaints were not established as cyberattack consequences.

Recovery and current status

Blackburn also described replacement Microsoft systems for teacher-computer backups, targeting completion by Christmas, and additional firewall protections. He said the district’s Microsoft systems were compromised while Google and Chromebook backups were unaffected. These are attributed recovery details, not proof of Microsoft’s own systems being breached or a Christmas outage end date.

He expected a final insurance payout within two weeks and described a $5,000 policy deductible. Neither the payout’s completion nor a total recovery cost was established.

The specific building-automation delay is the last documented operational impact, on Sept. 15. No definitive restoration notice or supported end date was found. Routine school communications do not negate the newer incident-linked facilities delay, and this classification does not establish that every earlier outage continued.

As of Oct. 19, the incident is presumed resolved because 34 days have passed since the latest supported operational-impact observation and no newer continuing disruption was established in the review. This is an assessment of operational status, not confirmation of complete restoration. The exact restoration date remains unknown.

Confidence and uncertainty

Confidence is high in the district-confirmed cyberattack and documented operational effects. Data availability and integrity were affected by inaccessible and unrecoverable local files. The July disclosure’s preliminary statement that information did not appear accessed or extracted is not a final forensic determination. No reviewed source establishes ransomware, a named actor, ransom activity or confirmed data theft.

Analytic gaps

Initial access, malware, affected-device count, encryption, final confidentiality findings, exact restoration and complete recovery costs remain unresolved. General phishing warnings are not evidence of this incident’s access vector.