Santa Fe Independent School District
Santa Fe ISD network security incident
Summary
A cyber event disrupted Santa Fe ISD internet, phones and visitor check-in, forcing testing changes in April 2025. Internet recovery remained incomplete April 25.
Key facts
Timeline
-
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Unknown cyber mechanism
The incident is confirmed to be cyber-related, but the specific attack mechanism is unknown.
Data impacts
-
Unknown data impact
The incident is cyber-related, but available evidence does not establish whether or how data was affected.
Operational impacts
-
Partial service outage
A service, system, platform, or operational capability remained available only in part or with significant limitations.
-
Network outage
Internal or external network connectivity was unavailable or materially impaired.
-
Internet access disruption
The organization lost or materially restricted internet connectivity.
-
Phone service disruption
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
-
Application unavailable
A specific application or software platform became unavailable or unusable.
-
Scheduling disruption
Appointment, booking, reservation, dispatch, staffing, or other scheduling functions were unavailable or impaired.
-
Educational operations disrupted
Instruction, student services, school administration, learning platforms, transportation, or other educational operations were materially affected.
-
Staff unable to work normally
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
Santa Fe Independent School District in Galveston County, Texas, experienced a cyber event during the weekend preceding its April 22, 2025, public notice. The district’s announcement shared by Santa Fe High School described a network interruption affecting internet and phone service. This direct acknowledgment establishes cyber involvement with high confidence, while the technical cause and precise intrusion date remain unknown.
Operational significance
The visitor check-in system was restored for campus visits beginning April 23. Junior-high and high-school STAAR testing moved to April 24–25, with elementary testing scheduled for the following week. These changes document disruption to educational operations and campus administration.
ABC13 reported that campus phones had been restored and that classes continued. Its account distinguishes restrictions on visitors and changes to testing from a districtwide class closure.
In his April 25 weekly message, Superintendent Kevin Bott said district internet was not yet fully restored and described staff adapting instruction while the technology team worked with service providers. Restoration of visitor check-in and phones therefore did not establish recovery of every affected service.
The incident is historically presumed resolved. No exact date for full network restoration has been established; the end date remains unknown rather than being inferred from a scheduled board meeting or the return of one service.
Confidence and uncertainty
The superintendent said there was no evidence at that time that sensitive student or staff data had been compromised. This is a dated investigative finding, not a permanent guarantee that every category of data was unaffected. Parents’ concerns about possible exposure do not establish data theft.
The reviewed primary evidence does not confirm ransomware, a ransom demand, a responsible group or an initial access method. Searches under the district’s canonical name, domain and common abbreviation returned no matching ransomware.live leads. Generic ransomware discussion in our Ghost article does not establish an attack mechanism for this incident.
Analytic gaps
The exact incident start, full restoration date, technical method and final data findings remain unverified. Law enforcement and outside cybersecurity assistance were reported; their involvement alone does not establish ransomware or information theft.
Organizations involved
Impacted locations
Santa Fe Independent School District, Texas
The district acknowledged a network interruption affecting internet and phones and rescheduled STAAR testing. This overlay records the school system’s geographic remit; it does not assert that every home or municipal service lost connectivity.
Santa Fe, Texas
Santa Fe contains the district’s administration offices and affected campuses. This physical place does not substitute for the larger school-district service area or establish a citywide outage.
Sources
We reported network disruption, changed testing schedules and restoration of the visitor check-in system at Santa Fe ISD.
A district notice said a weekend cyber event interrupted internet and phone service. Visitor check-in was restored for visits beginning April23; junior-high and high-school testing moved to April24–25 and elementary testing to the next week.
The report reproduced district cyber-event statements describing interrupted internet and phone service and revised STAAR testing schedules.
Classes continued while STAAR testing was rescheduled. A parent-provided district update said campus phones were restored; officials reported notifying law enforcement and an outside cybersecurity company.
The superintendent said district internet was not fully restored, staff adapted instruction and the technology team worked with providers on restoration. The district had found no evidence at that time of sensitive student or staff data compromise.
See something that needs correction?
Signed-in members can report an error, update, or missing source.