Springfield Public Schools shut down for four days in September due to a cyber incident that crippled district operations, The Boston Globe reported.
The cyberattack disabled email, phone systems, and computers, leaving administrators locked out of student transportation and meal preparation tools.
Schools had to close because staff lost access to critical student medical information. When classes resumed, teachers and students relied on printed materials while technical teams worked to bring systems back online.
Other districts across the state faced similar security threats around the same time. Sutton dealt with a cybersecurity problem affecting its school system, and Milford Public Schools thwarted a hacking attempt.
School districts including Woburn, Westford, and Millis were also impacted by the PowerSchool data breach. Schools remain prime targets for malicious actors due to the sensitive data they store, including students’ medical records, personal information, and household income.
Hackers typically demand ransoms to end cyberattacks, but preventing every breach is nearly impossible as artificial intelligence grows more powerful. School officials need to ensure education can continue during inevitable attacks by adopting cybersecurity drills similar to standard fire drills, according to The Boston Globe.
Schools should adopt an “assume breach” approach to plan for systems going offline.
“Running tabletop exercises are some of the best things these institutions can do to understand what goes down when X system goes down or when multiple systems go down, and how they can continue to stay operational,” said Cliff Steinhauer, director of information security and engagement for the National Cybersecurity Alliance.
Administrators can run these exercises by discussing alternative methods to handle attendance and medical software without computers. Districts can also simulate attacks by intentionally turning off specific systems to test staff response during the school year or over the summer.
Contingency planning costs little and helps schools identify weaknesses before a real attack occurs. However, drills alone do not solve all threats.
Districts still need to maintain strong passwords, require two-factor authentication, and track all software in use. Even with strong safeguards, sensitive data can still be lost, requiring schools to plan ahead to keep students in classrooms.
Keep reading