South Portland School Department
Cyberattack prompts South Portland school network shutdown
Summary
South Portland schools disconnected their network after an intrusion on Jan. 5, 2025. Systems were restored before classes began the next morning.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing. -
Incident end:
?
Confirmed or defensibly assessed end of material operational disruption or incident activity.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
Incident characteristics
Assessments
Attack mechanisms
-
Unauthorized access
Unauthorized access to systems, accounts, networks, or data.
Data impacts
-
No known data impact
Available evidence indicates that the incident did not materially affect the confidentiality, integrity, or availability of data.
Operational impacts
-
Partial service outage
A service, system, platform, or operational capability remained available only in part or with significant limitations.
-
Network outage
Internal or external network connectivity was unavailable or materially impaired.
-
Internet access disruption
The organization lost or materially restricted internet connectivity.
Extortion indicators
-
No known extortion indicator
Available evidence indicates that no extortion demand, threat, communication, or related pressure tactic was identified.
Incident narrative
What happened
South Portland School Department in Maine disconnected its network and internet service after detecting a cyberattack on Jan. 5, 2025. Technology Director Andrew Wallace told The Record that a monitoring service detected suspicious activity and a compromised firewall that Sunday. Staff disconnected equipment while they investigated.
Wallace told the Portland Press Herald that an attacker had accessed a remote-access server before reaching the firewall. The alarm gave the department time to isolate its network. The available accounts do not establish the initial access method or an earlier intrusion date.
Operational significance
The shutdown temporarily interrupted school network and internet availability. Wallace said systems were back online before classes began Jan. 6. Schools opened as scheduled, with phones and security systems operational. Human resources and financial services ran outside the compromised network, according to the Press Herald.
NEWS CENTER Maine reported that the incident was confined to the school department and did not affect other city systems. Cybersecurity specialists and city IT staff assisted with the response. The interruption still required urgent containment and recovery work despite occurring outside regular class hours.
Confidence and uncertainty
The named technology director’s account establishes a malicious intrusion and deliberate protective shutdown. After outside specialists reviewed access logs and network activity, Wallace believed student and staff information had not been compromised. That finding reflects the investigation at the time.
Wallace associated the activity with an IP address in Bulgaria. An IP address does not establish the attacker’s identity or nationality. The reviewed evidence does not establish ransomware, file encryption, a ransom demand or payment, and no responsible group has been identified.
Analytic gaps
The initial entry method, full earlier access period and identity of the intruder remain unresolved. The separately reported phishing incident at MSAD 51 and the prolonged disruption at Rutherford County Schools involved other school systems.
Organizations involved
Impacted location
South Portland, Maine
Matching Census TIGERweb ACS 2025 layers show that South Portland city 2371990 and unified school district 2312330 have identical 470-point polygons, identical land/water areas and identical bounds. Reuse the existing city as the school system’s geographic service remit rather than creating a duplicate district location. The paired organization service area and incident impacted area describe the affected school system’s jurisdiction, not identical effects on every resident or an outage of other municipal services. The NCES composite’s clipped coastal outline does not establish a separate legal boundary.
South Portland contains the school department’s central office and schools. Named reporting establishes interruption of the school network and internet, with systems restored before Monday classes. The municipal record is the physical anchor; this does not describe an outage of other city government systems.
Sources
See something that needs correction?
Signed-in members can report an error, update, or missing source.