Jerome School District: Jerome schools closed Monday after weekend cyber attack targets district networks and demands ransom

Jerome, Idaho School District Hit by Weekend Cyberattack, Forcing Closures

Jerome School District in Idaho shut down operations on Monday following a weekend cyberattack that targeted its networks, with hackers attempting to ransom district data. Superintendent Brent Johnson confirmed the attack began Saturday morning after internal alerts and reports from teachers signaled system disruptions.

The district’s IT team has been working continuously to restore networks and assess potential data exposure. While existing security policies helped limit the breach, attackers gained control of some internet-connected systems including security cameras, door locks, HVAC controls, and internet infrastructure prompting the decision to close schools. Johnson emphasized these systems are critical for student safety and daily operations.

Due to the ongoing investigation, details about the attackers’ demands, compromised data, and specific vulnerabilities remain undisclosed. However, Johnson expressed confidence that most student data remained secure. The district is pursuing a technical response rather than negotiating with the attackers, collaborating with law enforcement to investigate and prosecute those responsible.

Staff devices are undergoing security checks before reconnecting to the network. If systems are restored quickly, schools may reopen as early as Tuesday. The incident underscores the growing threat of cyberattacks on educational institutions and their operational vulnerabilities.

Source: https://www.kivitv.com/twin-falls/jerome-schools-closed-monday-after-weekend-cyber-attack-targets-district-networks-and-demands-ransom

Jerome School District TPRM report: https://www.rankiteo.com/company/jerome-school-district

"id": "jer1792455895",
"linkid": "jerome-school-district",
"type": "Ransomware",
"date": "10/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'customers_affected': 'Students, staff, and faculty',
                        'industry': 'Education',
                        'location': 'Jerome, Idaho, USA',
                        'name': 'Jerome School District',
                        'type': 'Educational Institution'}],
 'data_breach': {'sensitivity_of_data': 'Most student data believed to be '
                                        'secure'},
 'date_detected': '2023-10-28T00:00:00Z',
 'description': 'Jerome School District in Idaho shut down operations on '
                'Monday following a weekend cyberattack that targeted its '
                'networks, with hackers attempting to ransom district data. '
                'The attack began Saturday morning after internal alerts and '
                'reports from teachers signaled system disruptions. Attackers '
                'gained control of some internet-connected systems including '
                'security cameras, door locks, HVAC controls, and internet '
                'infrastructure, prompting the decision to close schools.',
 'impact': {'downtime': 'School closures (1+ days)',
            'operational_impact': 'School operations shut down, staff devices '
                                  'undergoing security checks',
            'systems_affected': 'Security cameras, door locks, HVAC controls, '
                                'internet infrastructure'},
 'investigation_status': 'Ongoing',
 'lessons_learned': 'Growing threat of cyberattacks on educational '
                    'institutions and their operational vulnerabilities',
 'motivation': 'Financial gain',
 'ransomware': {'ransom_paid': 'No'},
 'references': [{'source': 'Local news report'}],
 'response': {'containment_measures': 'Disconnected affected systems, security '
                                      'checks for staff devices',
              'incident_response_plan_activated': 'Yes',
              'law_enforcement_notified': 'Yes',
              'recovery_measures': 'Potential reopening as early as Tuesday if '
                                   'systems are restored',
              'remediation_measures': 'Restoring networks, assessing data '
                                      'exposure'},
 'title': 'Jerome School District Cyberattack',
 'type': 'Ransomware'}