Santa Fe Independent School District

Summary

Over a weekend, a cyber event disrupted internet and phone service across the Santa Fe Independent School District, prompting administrators to engage their internal technology team, notify law enforcement, and bring in an external cybersecurity firm. While classes continued, the outage forced the rescheduling of STAAR testing for junior high and high school students, with elementary testing pushed to the following week. Phones and the visitor check-in system have since been restored as remediation efforts continue. Some parents raised concerns about potential exposure of sensitive student information such as Social Security numbers and addresses, though other parents reported being told by the district that private data remained secure, leaving families awaiting further clarification.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Over the weekend prior to April 1, 2025, Santa Fe Independent School District in Texas began experiencing a network interruption that disrupted both internet and phone service across its campuses. The district initially communicated the situation to the public through a social media post, describing the event as a network interruption rather than immediately labeling it as a cyberattack. As the days progressed and the technical issues persisted, the district shifted its terminology, publicly referring to the situation as a "cyber event." This wording suggested an acknowledgment that the disruption was caused by an external malicious actor or intentional digital intrusion, though specific details about the nature of the event were not disclosed in the early communications. The disruption affected basic operational infrastructure, including telephone lines and internet connectivity used by staff and administrators throughout the district.

As the incident unfolded through the first days of April 2025, parents of students in the district sought clarification and transparency regarding the scope and implications of the cyber event. Some parents, such as Claudia Covarrubias, expressed frustration with the district's communications, noting that the answers provided were brief and open to interpretation rather than offering clear, direct explanations. Covarrubias specifically voiced concern that sensitive personal information belonging to students, including photographs, Social Security numbers, home addresses, and other identifying data, might have been compromised during the breach. The uncertainty surrounding whether private student information had been exposed was a major point of concern among families during this period. Conversely, another parent, Jessica Knowles, reported that district representatives had informed parents that all sensitive information, including Social Security numbers and lunch account funds, was considered private and secure. Despite this reassurance, Knowles echoed the broader sentiment of the parent community by asking who was responsible for targeting the school district and why such an attack would be carried out against a relatively small educational system.

The operational impacts of the cyber event extended beyond communication outages and affected core academic functions within the district. Classes continued to operate despite the disruption, but the loss of internet and phone services created significant logistical challenges for administrators. Most notably, the incident forced the rescheduling of standardized State of Texas Assessments of Academic Readiness, commonly known as STAAR testing. Junior high and high school students who had been scheduled to take the STAAR tests on Thursday and Friday were unable to do so as planned, with their examinations pushed to a later date. Elementary school students, whose testing had been scheduled for the following week, were similarly impacted, with their assessments also rescheduled as a result of the ongoing network problems. Additionally, the district's visitor check-in system, which is typically used to monitor and screen individuals entering school campuses, was temporarily knocked offline before eventually being restored during the recovery process.

In response to the cyber event, district officials took several immediate steps to manage the crisis and restore essential services. The district's internal technology team was mobilized to address the network issues and work toward restoring functionality to affected systems. Working phone service on campuses was eventually reestablished in the days following the initial outage, marking one of the first major recovery milestones. Law enforcement authorities were also notified about the incident, signaling that the district was treating the event as a potential criminal matter. Furthermore, the district engaged an external cybersecurity company to assist with investigating the breach, assessing the extent of the intrusion, and supporting remediation efforts. While these response actions were underway, parents and community members continued to await more comprehensive details about the incident, including the identity of the threat actor, the specific vulnerabilities exploited, and confirmation regarding the safety of student and staff data. The combination of operational disruption, academic rescheduling, and unresolved questions about data security left the Santa Fe community seeking greater transparency as the district worked through the recovery process.

Sources

Sources available to members: 1 source.