The Ohio School Boards Association
Ohio School Boards Association cyberattack
Summary
An August 2024 cyberattack disabled the Ohio School Boards Association’s website and email and disrupted member communications. Its CEO reported no ransom demand at the time. The attacker and final restoration date remain unverified.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Unauthorized access
Unauthorized access to systems, accounts, networks, or data.
Data impacts
-
Unknown data impact
The incident is cyber-related, but available evidence does not establish whether or how data was affected.
Operational impacts
-
Network outage
Internal or external network connectivity was unavailable or materially impaired.
-
Internet access disruption
The organization lost or materially restricted internet connectivity.
-
Email disruption
Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.
-
Website unavailable
A public-facing website was unavailable, disabled, or inaccessible.
-
Staff unable to work normally
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
Extortion indicators
-
No known extortion indicator
Available evidence indicates that no extortion demand, threat, communication, or related pressure tactic was identified.
Incident narrative
Analyst assessment
A cyberattack disrupted the Ohio School Boards Association’s communications in August 2024. Members discovered problems Aug. 8 when email and website access failed, and the association disconnected from the internet. CEO Kathy McFarland directly described the incident to WOSU the next day.
The incident is presumed resolved, with no verified final restoration date. The available contemporary reporting establishes a network breach and resulting service disruption. It does not establish that ransomware caused the outage.
Operational significance
The association’s website and email remained unavailable Aug. 9, hindering communication with members. WSYX’s reporting described disruption during preparations for the new school year, when members relied on the association for guidance and support.
The affected organization supports school boards; it is not itself a school district. The evidence does not establish classroom closures, failed school transportation or simultaneous outages across member districts. Membership figures describe the association’s reach, rather than a count of independently affected organizations.
Confidence and uncertainty
Confidence in the cyberattack assessment is high because the CEO acknowledged a breach and described the response. She told WSYX that someone breached the system at 12:49 p.m. Aug. 8 and that outside forensic specialists were handling the investigation.
McFarland also reported no ransom demand as of Aug. 9. She said there was no indication sensitive member information had been compromised and explained that the association did not typically store such data. These were assessments at that stage of the investigation, not a completed forensic inventory or proof that no information was accessed.
Analytic gaps
Aug. 8 is the documented disruption and discovery day; the first verified public cyberattack acknowledgment is Aug. 9. The latest precisely dated continuing service disruption is also Aug. 9. The final recovery day and duration of individual service failures remain unverified.
The attacker, initial-access method, affected data inventory and any later extortion activity remain unknown. References to Rhysida in coverage concerned the separate City of Columbus attack. They do not establish a connection to the association’s breach.
Organizations involved
Impacted locations
Columbus, Ohio
Columbus contains the affected association’s administrative headquarters at 8050 N. High St., Suite 100.
Franklin County, Ohio
Franklin County contains affected association’s administrative office. No implication of county government compromise or countywide service disruption.
Sources
We reported the cyberattack that disabled the association’s website and email and disrupted member communications. Our account describes outside specialists assisting recovery and the CEO’s initial assessment of possible sensitive-data involvement.
Reports that the association’s website and email remained down Aug. 9. Its CEO describes an Aug. 8 breach, a letter to members and no ransom demand at that point, with outside forensic specialists investigating.
The association’s CEO describes email and website failures discovered Aug. 8, immediate internet disconnection and outside IT assistance. She says there was no indication sensitive member information had been compromised at that time.
See something that needs correction?
Signed-in members can report an error, update, or missing source.