Skip to content
DysruptionHub
Sign in Subscribe

Wayne-Westland cyberattack disrupts networks and phones

Summary

Wayne-Westland Community Schools logo

Malware disrupted Wayne-Westland Community Schools’ networks, internet and phone services in December 2024. Schools continued operating with workarounds while external phone restoration extended into January.

Key facts

Timeline

  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted locations

Organization types

Critical infrastructure sector

DysruptionHub coverage

Incident characteristics

Assessments

Cyber assessment:
Confirmed
Status:
Resolved
Incident confidence:
High
Ransomware:
Unresolved
Attribution:
Unresolved

Attack mechanisms

  • Malware

    Malicious software other than ransomware used to compromise or disrupt systems.

Data impacts

  • Data encryption

    Data was rendered inaccessible through unauthorized encryption, including ransomware-related encryption.

Operational impacts

  • Partial service outage

    A service, system, platform, or operational capability remained available only in part or with significant limitations.

  • Network outage

    Internal or external network connectivity was unavailable or materially impaired.

  • Internet access disruption

    The organization lost or materially restricted internet connectivity.

  • Phone service disruption

    Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.

  • Internal systems unavailable

    Internal business, administrative, operational, or staff-facing systems were unavailable.

  • Educational operations disrupted

    Instruction, student services, school administration, learning platforms, transportation, or other educational operations were materially affected.

  • Manual workaround required

    Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.

  • Alternate service channel required

    The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.

Extortion indicators

  • Leak-site listing

    The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.

Incident narrative

Malware disrupted district systems

Wayne-Westland Community Schools in Michigan identified technical problems on or about Dec. 3, 2024. The district’s Dec. 4 notice said malware had encrypted some systems and interrupted internet and phone services. It engaged forensic specialists and notified law enforcement.

Schools continued with workarounds

The district kept schools open. Staff used cellphones, messaging services, walkie-talkies and mobile hotspots to communicate while systems were unavailable. Officials said school doors remained secured and staff continued checking identification when adults collected students.

WXYZ reported that internet access had partly returned Dec. 6. Teachers adjusted lessons, while phone restoration remained incomplete. A nearby police incident and a separate school threat also affected the district that week; those events did not establish cyberattack-related school closures.

Recovery continued into January

In a Jan. 9 update, the district said it had rebuilt multiple servers. Printers and internal phone lines were operating, but external phones still required restoration.

A Jan. 23 letter said external phone service was partly restored and schools could call families. Incoming callers could encounter a hold while staff worked with service providers to restore full capacity. The reviewed letters do not establish an exact final restoration date.

Data investigation and actor claim

Comparitech reported a RansomHub claim alleging theft of 4 terabytes of district data. A ransomware.live record shows the listing was observed Feb. 9, 2025. That observation is separate from the December disruption; it does not verify the volume or contents of stolen information or establish who caused the attack.

In its Feb. 26 update, the district said its investigation had not confirmed that student or staff information was compromised. It said it would notify affected people if sensitive information was found to have been affected. The reviewed sources do not establish a ransom payment or the initial intrusion method.

Threat actor and claim

RansomHub

Listed as: wwcsd.netSource: ransomware.liveDiscovered:

Claim details

RansomHub listed the district domain in a claim observed Feb. 9, 2025. Comparitech reported the listing and an allegation of 4 terabytes of stolen data. Observation corroborates the listing’s existence, not its original publication time, claimed volume or contents, password-weakness allegation or operator responsibility. District letters confirm malware encryption and disruption but had not confirmed student or staff information compromise. No ransom payment or initial vector is established.

Organizations involved

Impacted locations

  • Wayne-Westland Community School District, Michigan

    Official notices describe district network and communications disruption. The exact school district area represents affected authority scope; schools remained open and no citywide or countywide outage is inferred.

  • Westland, Michigan

    The affected district’s verified administrative office is in Westland at 36745 Marquette Street. Its city anchor does not represent the complete district jurisdiction or establish impact to every Westland resident.

Sources

1-9-25 Phone outage updates
Wayne-Westland Community SchoolsPublished: Retrieved:
  • Type: Official Statement
  • Platform: Website
  • Medium: Web
1-23-25 Phone outage updates
Wayne-Westland Community SchoolsPublished: Retrieved:
  • Type: Official Statement
  • Platform: Website
  • Medium: Web
2-26-25 Cyber Security Update
Wayne-Westland Community SchoolsPublished: Retrieved:
  • Type: Official Statement
  • Platform: Website
  • Medium: Web
Published Last updated

See something that needs correction?

Signed-in members can report an error, update, or missing source.