A cyberattack disrupted Traverse City Area Public Schools’ network and canceled classes April 1 and 2, 2024. A later district notice confirms file acquisition around March 19, with personal-information review continuing into 2025. Medusa’s reported ransom demand and claimed data volume remain unconfirmed; the exact technical recovery date is unknown.
Unauthorized access to systems, accounts, networks, or data.
Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.
Stolen, exposed, or otherwise compromised data was publicly released, posted, distributed, or offered for download.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Internal or external network connectivity was unavailable or materially impaired.
Internal business, administrative, operational, or staff-facing systems were unavailable.
Instruction, student services, school administration, learning platforms, transportation, or other educational operations were materially affected.
Scheduled events, meetings, hearings, classes, procedures, programs, or other activities were canceled.
The actor threatened to disclose, sell, distribute, or otherwise misuse stolen data unless the victim paid or complied with demands.
The actor explicitly threatened to publish or publicly release victim data or incident details.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
Traverse City Area Public Schools disconnected its network after detecting a disruption in late March 2024, canceling classes April 1 and 2. A later district notification dates unauthorized file acquisition to about March 19. The incident affected the Michigan school district’s operations and exposed personal information; the full technical and data scope remains uncertain.
The district’s notification letter filed with Massachusetts regulators says an unauthorized party acquired electronic files on or about March 19, 2024. It describes containment, forensic investigation and a manual document review that identified potentially affected personal information around May 20, 2025. That later finding establishes additional data consequences without showing that systems remained unavailable into 2025.
Contemporaneous reporting quoting district officials documents the March 30 public acknowledgment, network isolation and outside cybersecurity assistance. March 28 was the reported disruption-detection date, rather than the earliest malicious activity established by the later letter.
The district’s statements reproduced by 9&10 News link the two canceled school days to network isolation and infrastructure testing. Officials planned to resume classes April 3. That announcement does not establish when every application or device returned to normal. The educational interruption is well documented, while a precise technical restoration date remains unknown.
Confidence is high in the network disruption, class cancellations and unauthorized file acquisition because district statements directly support them. Comparitech reported that Medusa demanded $500,000 to withhold alleged stolen data, while noting that the district had not confirmed the demand. The claimed 1.2-terabyte volume remains unverified.
The 74’s investigation reported that employee information appeared online, citing earlier local reporting and a staff member’s discovery. The district’s later letter confirms file acquisition but does not identify Medusa, establish its claimed volume or disclose the full contents in the public template. Attribution remains qualified, and actual encryption is not established.
The entry method, complete affected population and data categories, extent of encryption, payment outcome and final restoration date remain unresolved. This district incident is separate from the June 2024 city/county government attack and the later PowerSchool breach.
Medusa’s listing identifies tcaps.net and alleges 1.2 terabytes of data. Ransomware.live recorded discovery April 14, 2024; the original claim publication date is unknown. Comparitech reported a $500,000 demand to avoid sale or release. The district confirmed file acquisition around March 19 but did not name Medusa or confirm its claimed volume. Reporting describes employee information online; exact contents and responsibility remain qualified.
The affected school district serves portions of Grand Traverse, Benzie and Leelanau counties. The attack disrupted district operations and classes, without establishing identical effects at every school.
Traverse City is the district’s physical anchor, identified by the office address in its consumer notification. The district’s educational area is represented separately.
The district’s March 30 evening message described network disruption, outside cybersecurity assistance and cancellation of April 1 classes. Officials had not yet determined whether classes could resume April 2.
Officials described network isolation and cancellation of April 1-2 classes, with testing before a planned April 3 return. An April 16 update acknowledged a ransomware claim and a continuing investigation into information exposure.
Comparitech reported a $500,000 Medusa demand to avoid sale or release of an alleged 1.2 terabytes of district data. The district had not confirmed the demand.
The TCAPS case describes reported exposure of employee information and a staff member’s discovery of personal data online. It cites local reporting and describes a $500,000 Medusa demand.
The district says an unauthorized party acquired files around March 19, 2024. A forensic investigation and manual review identified potentially affected personal information around May 20, 2025.
The tracker lists TCAPS and tcaps.net under Medusa and records an allegation that 1.2 terabytes of data were taken. The volume remains unverified.
Signed-in members can report an error, update, or missing source.
