Former Saydel IT worker sabotaged school systems

Analyst assessment

DysruptionHub assesses with high confidence that Saydel Community School District experienced a sustained insider-linked cyber-sabotage campaign after a former IT employee retained privileged credentials. A federal charging record placed the admitted conduct from at least May 14, 2023, through at least January 16, 2025. The U.S. Attorney’s Office for the Southern District of Iowa later said Ezekiel Dean Potter downloaded more than 300 district usernames and passwords before his April 2023 termination and used them to access or attempt to access district accounts and applications. Potter pleaded guilty to computer fraud and was sentenced June 11, 2026, to 21 months in prison, three years of supervised release and $59,668.81 in restitution.

DysruptionHub’s published report said the activity included deleting the district’s Facebook page, disabling Apple device management, attempting to interfere with website hosting, temporarily disabling Schoology and deleting employee email accounts. The conduct was intentional, repeated and operationally disruptive rather than a single isolated access event.

Operational significance

Federal prosecutors said the attacks caused districtwide technology outages and required substantial remediation by district staff. The campaign culminated in January 2025 attacks on district applications that suspended classes for multiple hours. Schoology was temporarily unavailable during a school day, preventing teachers from using the learning platform for instruction.

The offender also interfered with Apple School Manager, which impaired management of district MacBooks and iPads, and deleted or revoked access to employee accounts and other district resources. These actions affected classroom technology, staff authentication and administrative control over managed devices. January 16, 2025, is the latest specific date in the charged conduct; no later operational impact was found.

Disclosure posture

The strongest public evidence comes from the federal prosecution, public court records and reporting based on sentencing materials. The Justice Department’s account is directly authoritative and documents both the malicious computer activity and material disruption, supporting an OC-OD classification. This does not mean Saydel published the operational account: the district did not appear to issue a detailed public statement identifying the full campaign, its duration or its effects. The case became fully documented through prosecution and sentencing rather than contemporaneous district disclosure.

Current status

The malicious activity ended by January 2025, and the identified offender was prosecuted and sentenced in June 2026. The known incident is therefore resolved, although public records do not establish whether the district completed every credential, identity and device-management remediation measure prompted by the campaign.

Confidence and uncertainty

Confidence is high in the cyber characterization, disruption and offender identification because the conclusions are supported by a guilty plea, sentencing evidence and a federal prosecution. This is not ransomware or extortion. The primary mechanism was unauthorized use of retained credentials by a former trusted employee, followed by account deletion, access revocation and sabotage of district services.

The record also establishes a data-security impact: Potter possessed hundreds of district credentials and other sensitive district information on a USB drive. Public reporting does not establish that student or employee personal information beyond credentials was disclosed to third parties or publicly released.

Analytic gaps

The public record does not provide a complete event-by-event timeline, identify every compromised account, or establish how long each outage lasted. It also does not explain whether multi-factor authentication was enabled, how former-employee access was revoked, which recovery controls failed, or whether the district conducted a broader notification or independent security review.