Delano Public Schools and Spring Lake Park Schools: Delano becomes latest Minnesota school district hit by ransomware attack

Cyber Incident Disrupts Delano Public Schools, Classes Canceled

Delano Public Schools in Minnesota canceled classes on Wednesday after detecting a cyber incident early Tuesday morning. District officials reported that an unauthorized party accessed their systems, printing hundreds of pages across multiple locations with the word "ransom" at the top though the rest of the message remained encrypted.

Superintendent Matt Schoen confirmed the breach was external, ruling out internal involvement, including students. While the district’s network was compromised, Schoen stated that student and staff personal data likely remained secure due to existing safeguards. No ransom demands have been received, and authorities, including the FBI, are investigating the source of the attack.

The incident follows a similar disruption in Spring Lake Park last month, where a hacker forced a two-day school closure after infiltrating systems. Cybersecurity expert Bryce Austin of TCE Strategy noted that schools are frequent targets due to outdated technology, comparing their security measures to "a car built before seat belts" difficult and costly to retrofit.

Delano officials reported that their containment protocols limited the breach’s impact, isolating internal servers and preventing access to sensitive data. Students are set to return Thursday, with the district temporarily relying on ethernet connections as a precaution. The investigation remains ongoing, with no clear attribution yet.

Source: https://www.cbsnews.com/minnesota/news/delano-schools-closed-cyber-incident/

Delano Public Schools TPRM report: https://www.rankiteo.com/company/city-of-delano-delano-mn

Spring Lake Park Schools TPRM report: https://www.rankiteo.com/company/springfield-public-schools-19

"id": "citspr1779337629",
"linkid": "city-of-delano-delano-mn, springfield-public-schools-19",
"type": "Ransomware",
"date": "5/2026",
"severity": "75",
"impact": "2",
"explanation": "Attack limited on finance or reputation"

{'affected_entities': [{'customers_affected': 'Students and staff',
                        'industry': 'Education',
                        'location': 'Delano, Minnesota, USA',
                        'name': 'Delano Public Schools',
                        'type': 'Educational Institution'}],
 'data_breach': {'data_encryption': 'Partial (ransom message encrypted)',
                 'personally_identifiable_information': 'Likely none',
                 'sensitivity_of_data': 'Low (personal data likely secure)'},
 'date_detected': '2023-10-17T00:00:00Z',
 'date_publicly_disclosed': '2023-10-18T00:00:00Z',
 'description': 'Delano Public Schools in Minnesota canceled classes on '
                'Wednesday after detecting a cyber incident early Tuesday '
                'morning. An unauthorized party accessed their systems, '
                'printing hundreds of pages across multiple locations with the '
                "word 'ransom' at the top though the rest of the message "
                'remained encrypted.',
 'impact': {'data_compromised': 'Likely none (student and staff personal data '
                                'remained secure due to safeguards)',
            'downtime': '1 day (classes canceled on Wednesday)',
            'identity_theft_risk': 'Low (personal data likely secure)',
            'operational_impact': 'Classes canceled, temporary reliance on '
                                  'ethernet connections',
            'systems_affected': 'District network, internal servers'},
 'investigation_status': 'Ongoing',
 'lessons_learned': 'Schools are frequent targets due to outdated technology '
                    'and security measures that are difficult and costly to '
                    'retrofit.',
 'post_incident_analysis': {'root_causes': 'Outdated technology and security '
                                           'measures'},
 'ransomware': {'data_encryption': 'Partial (ransom message encrypted)',
                'ransom_demanded': 'No ransom demands received'},
 'recommendations': 'Upgrade cybersecurity infrastructure, implement modern '
                    'security protocols, and enhance monitoring.',
 'references': [{'date_accessed': '2023-10-18T00:00:00Z',
                 'source': 'Local news report'}],
 'response': {'containment_measures': 'Isolated internal servers, prevented '
                                      'access to sensitive data',
              'incident_response_plan_activated': 'Yes',
              'law_enforcement_notified': 'FBI',
              'remediation_measures': 'Temporarily relying on ethernet '
                                      'connections'},
 'title': 'Cyber Incident Disrupts Delano Public Schools',
 'type': 'Ransomware'}