Springfield Schools Begin Laptop Rebuild After Cyberattack Disrupted Classes

GovTech Education detailed a Springfield, Massachusetts, school cyberattack recovery that has moved into a device-by-device restoration phase after the incident knocked out core district systems and canceled classes for four days.

The attack hit just before Labor Day weekend and left the district without email, phones or access to records.

Classes resumed Sept. 14 after essential services, including email, phones, medical records and food service records, were brought back online, but the technology disruption has continued to shape daily instruction across the system.

Teachers have leaned heavily on textbooks, paper and pencils while information technology staff rebuild the district's systems with help from the city's computer department and outside cybersecurity consultants.

The recovery has focused first on getting teachers connected again and making sure children with disabilities who depend on computers to communicate can use the tools they need.

The next operational step is the reimaging of student laptops.

School communications director Azell Cavaan described the process as a clean reset with stronger security before the devices return to regular use, and the district plans to move through student and staff machines in phases because thousands of laptops are involved.

That sequencing makes the recovery less like a single restart and more like a controlled rebuild of classroom technology.

Superintendent Sonia Dinnall framed the district's position as progress under constraint: schools are open, students are learning, essential operations are functioning and the technology restoration is advancing.

The same recovery period has also opened a labor-management front.

The Springfield Education Association has asked to renegotiate working conditions tied to the attack and has put forward 14 proposals.

Those proposals include calls for a fully rebuilt and secured system, restored Wi-Fi in every school, working printers and copiers, and the return of all computers to use.

The union also wants standardized testing halted, classroom evaluations paused and any negative reviews erased until systems are restored, turning the cyber recovery into a question of instruction, labor conditions and accountability as well as infrastructure.

Investigators are still measuring the data exposure.

The FBI, Massachusetts State Police and local detectives are continuing the inquiry, and officials have confirmed that some stolen data has appeared on the dark web.

Known exposed information includes names, birthdates and addresses, along with other staff and student data categories.

Whether staff Social Security numbers were accessed remains under review; the district does not routinely keep those numbers for students.

Employees are being offered two years of complimentary identity protection through IDX, with registration information being mailed to staff.

Mayor Domenic J. Sarno, who chairs the School Department, has characterized the attackers as a sophisticated global group targeting large organizations in the United States and Europe and using artificial intelligence to compromise systems.

The financial exposure is still unresolved.

Patrick Roach, the district's chief financial officer, said the total cost is not known, while Sarno is seeking emergency help from state and federal representatives, including U.S. Sens. Elizabeth Warren and Edward Markey and U.S. Rep. Richard E. Neal.

Sarno has not disclosed a ransom demand, and he has argued that education money should be spent on students rather than attackers.

The district's final recovery phase remains open-ended.

Alongside laptop reimaging and system restoration, Dinnall said the schools are upgrading network security and training intended to reduce the risk of another attack.