Zion Elementary School District 6 in northern Illinois closed all schools and district offices Monday and Tuesday, Dec. 1–2, after reporting a cybersecurity incident that may have compromised electronic files and servers across the district.
In a notice posted to its ALERT Tracker on Nov. 30, the district said it was “responding to a cyber security incident that may have compromised electronic files and servers across the district” and was working to determine “the credibility and full extent of this potential breach.” Officials said schools and the district office would be closed Monday for all students and staff “to allow for a thorough, immediate investigation of this matter,” and called the situation a “critical matter.” All before- and after-school activities were canceled.
A follow-up update on Dec. 1 said all schools and offices will also be closed Tuesday, Dec. 2, with before- and after-school programs again canceled. The district said some services have been suspended and that it is working with third-party cybersecurity specialists “to evaluate the nature and scope of this incident and restore functionality as securely and quickly as possible.” Classes remain in session for students attending out-of-district instructional programs, and transportation for those students continues as scheduled.
The district has not said what triggered the incident, whether it involves ransomware or another type of attack, or which systems are affected. No law enforcement partners or outside response firms have been named publicly beyond the cybersecurity specialists, and officials have not confirmed whether any student or staff data has been accessed. Zion said updates will be posted to its ALERT Tracker page, which it uses alongside phone, email and text messages to reach families in emergencies.
Zion Elementary School District 6 is a stand-alone Illinois district that runs only pre-K through eighth-grade schools, while high school is handled by a separate district. It serves more than 2,000 students across seven campuses in the city of Zion, a Lake County community along Lake Michigan north of Chicago.
This is not the first time the district has been caught up in a cyber incident. In January 2025, Zion reported that education software vendor PowerSchool had suffered a data breach involving its student information system, describing it as a global incident that affected the district and issuing breach notifications in English and Spanish.
Vendor and on-premises attacks have become a persistent problem for K-12 systems. The nonprofit K12 Security Information eXchange’s Cyber Incident Map has logged more than 1,600 publicly reported cyber incidents affecting U.S. K-12 schools between 2016 and 2022, and a separate analysis found at least 116 school districts reported ransomware incidents in 2024 alone.
Zion’s shutdown is part of a broader pattern of disruptive attacks on K-12 systems. This fall alone, Jackson County schools in North Carolina closed after a DDoS attack on district networks, Michigan’s South Lyon Community Schools canceled two days of classes after a security incident took down parts of its systems, and Kearney Public Schools in Nebraska reported a cyberattack that compromised its network and knocked out phones and email. A separate multi-day outage at school-communications vendor Finalsite disrupted emergency alerts for districts in several states, underscoring how both local networks and shared third-party tools have become targets.
As of Monday evening, Zion officials had not said how long the investigation and remediation might take or whether closures could extend beyond Tuesday. Families are being urged to monitor the ALERT Tracker page for further instructions on school schedules and any notification if personal data is found to be at risk.
