(TNS) — Federal agents suspect the hacker group that seized the city’s School Department network in August and early September was Interlock, “an attacker known to the FBI,” according to a Sept. 30 report the district submitted to the state.The breach, discovered in early September, cut off access to email, phone, computers and vital records. The district canceled school for days.Under state law, information about breaches must be reported to the Office of Consumer Affairs and Business Regulation.Though the breach was discovered in early September, it started Aug. 15, according to the report submitted to the state by Lauren Ostberg, an attorney at Springfield firm Bulkley, Richardson and Gelinas, who was representing the School Department.On Sept. 5, the School Department found its server was being encrypted, according to the report.The hackers had broken into the school district’s server and installed malware, or malicious software, which allowed the cyber villains to control the system remotely and encrypt the servers. The attackers then demanded a ransom.Interlock ransomware was first spotted by authorities in September 2024. It has attacked computer systems in Europe and North America, according to an FBI alert from July 2025.Last month, Assistant Superintendent Jose Escribano described the suspected hackers but did not divulge the group’s name.“They are a professional and active world-known organization that targets large organizations in the U.S. and Europe,” he said in mid-September.Azell Cavaan, a school spokesperson, said on Tuesday that she was unable to provide the amount attackers demanded.City and school representatives have not previously responded to questions about whether a ransom was sought.“Money goes to our kids, not to these individuals,” Mayor Domenic J. Sarno said last month, seeming to suggest there was a ransom demand. “We move forward. They don’t win.”The district was able to regain control of the system.“With the help of the FBI, law enforcement, cybersecurity professionals, and its own technical staff, SPS was able to remove the attacker from its servers,” the report to the state reads.State police declined to comment and directed inquiries to the FBI, which did not immediately respond to a request for comment.In mid-September, the school district found that its stolen data had been posted on the dark web.The FBI and state police have been investigating, and Cavaan said that the inquiry remains open.“It’s hard to say how long the investigation will go on, because this was such a sophisticated attack,” she said.In the weeks since the breach, the school district has been working to determine what information was stolen and contacting affected people. The full depth of what was taken is still being determined, and at this point the most sensitive stolen information is believed to be personally identifying data, including Social Security numbers from current and former staff and volunteers, Cavaan said. The district is working to reach everyone affected to offer credit monitoring services.Student information was taken, but the vast majority of students did not have their Social Security numbers taken, because students’ numbers are not stored on district platforms, Cavaan said.The district is back online, but still working to restore all of its systems, including all computers, a process in which students who require them to learn have been prioritized.Some staffers in the district’s central office had to move to other city offices, so they could access necessary systems not yet available in the schools, Cavaan said.“We are not back to 100 percent capacity,” she said.Cyber attacks on schools are very common, said T.J. Sayers, senior director of threat intelligence at the Center for Internet Security, a nonprofit in New York. The “lion’s share” of those attacks are ransomware related, he said.Schools are vulnerable targets because they don’t typically have larger cybersecurity budgets and often there’s a high-level of urgency to resolve the issue to get children back in school. “It’s the perfect, unfortunately, recipe for a financially motivated threat actor to go after them,” Sayers said.“I can’t emphasize enough it’s no fault of these K-12s in basically every case this happens. You have extremely under-resourced organizations that are in need of help being attacked by very sophisticated criminal enterprises.”MassLive senior reporter Hadley Barndollar and The Republican’s enterprise editor, Daniel Jackson, contributed to this report.©2026 Advance Local Media LLC. Distributed by Tribune Content Agency, LLC.
window.fbAsyncInit = function() {
FB.init({
appId : ‘314190606794339’,
xfbml : true,
version : ‘v2.9’
});
};
(function(d, s, id){
var js, fjs = d.getElementsByTagName(s)[0];
if (d.getElementById(id)) {return;}
js = d.createElement(s); js.id = id;
js.src = “https://connect.facebook.net/en_US/sdk.js”;
fjs.parentNode.insertBefore(js, fjs);
}(document, ‘script’, ‘facebook-jssdk’));
Click Here For The Original Source.
——————————————————–
