Cyber Incident Victim: Tigerton School District
Date:
May 2021
Location:
United States of America
Summary
A ransomware attack disrupted the Tigerton School District's computer network, causing internet connectivity issues and limiting access to critical systems. The incident forced a five-day closure of schools before students could return, with the superintendent confirming the cyberattack's role in the ongoing operational challenges.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In early May 2021, the Tigerton School District in Wisconsin experienced a significant disruption to its computer network operations due to a ransomware attack. The incident forced the district to cancel classes for five consecutive days, extending a scheduled weekend break as administrators addressed the technical issues. Students returned to classrooms on May 10, though internet connectivity problems persisted across district systems. Superintendent Kelley Strike formally confirmed the ransomware attack's role in the outage through an email statement to FOX 11 News on May 11, characterizing the incident as a "sophisticated ransomware attack" that compromised critical network functionality. The attack specifically impaired administrative and educational systems reliant on internet access, though the district did not publicly specify whether student or employee data was exfiltrated during the breach.
The cyberattack's operational impacts continued beyond the initial five-day closure, with residual internet accessibility problems affecting daily school functions despite the resumption of classes. Superintendent Strike's May 11 disclosure represented the district's primary public communication regarding the incident's nature and scope, though no further technical details about the ransomware variant, attack vector, or demanded ransom were released. The forced network shutdown demonstrated the attack's severity, requiring extended downtime to contain the compromise. No additional mitigation measures, recovery timelines, or law enforcement involvement were detailed in the available public statements. The disruption highlighted the attack's material consequences for educational continuity, though academic operations gradually resumed with limited technological capabilities during the recovery phase.