Springfield's school network shutdown pushed more than 100 children into YMCA day care

The containment call is what closed the buildings. Superintendent Sonia Dinnall directed all district staff to stay off Springfield Public Schools network systems until more was known, and told students holding district-issued laptops to do the same ^[2]. The district said the closure would also let administrators organize backup plans for non-essential technology tools, attendance reporting among them ^[5]. Central Office stayed open, though phone lines were among the services affected ^[4].

The two official accounts of the calendar do not line up cleanly. The district's own notice closed schools on Tuesday, September 8 ^[1]. The Cyber Express reports schools were shut for the second half of the same week, with a professional development day on the Friday ^[8][21]. That documents at least three closed school days, and neither source says whether the Wednesday in between was open ^[23]. Students are due back Monday ^[10], which by the calendar is September 14, six days after the first closure ^[24].

"The decision to close schools is not made lightly," Dinnall said ^[6]. She said the health and safety of people inside the buildings would always be the first consideration, and that the district was "not willing to risk any lapse in that" ^[7].

Childcare moved to a nonprofit. The YMCA of Greater Springfield opened full-day care to any family already enrolled in its before- and after-school programs ^[12]. "We opened our doors to all of our families we serve in our before- and after-school programs for full-day care until the school system is able to reopen its doors," CEO Dexter Johnson told 22News ^[13].

The data questions are the ones still open. In a letter sent Wednesday, the Springfield Education Association asked which categories of employee data, including health, financial and Social Security information, may have been exposed, whether the breach triggers mandatory legal reporting obligations, and what support the district will give staff whose personal information was compromised ^[18]. The union also asked how buildings will be kept secure without working phone systems and other safety infrastructure, and how students who depend on assistive technology will be served ^[19]. Union president Riley Hernandez said he asked for a formal meeting with Dinnall and her cabinet and got no response ^[22]. "I still have not received an invitation to meet with Dr. Dinnall and her cabinet. Many unanswered questions still remain. It is not clear where the District is at in fully resolving this cyber incident or what sensitive information the breach has compromised," Hernandez said in a Thursday statement ^[17].

Neither the district notice nor the reporting names a threat actor, a malware family, or a ransom demand ^[25]. Mayor Domenic Sarno used the phrase "cyber attack" repeatedly at Thursday's news conference and blamed the "cyber attack hackers" behind it ^[15]; Dinnall said the exact scope and size remained under investigation ^[3]. Those two statements are compatible, and an investigation that cannot yet scope the intrusion also cannot tell 2,700 employees whether their Social Security numbers moved ^[16].

Hernandez said educators would "be expected to deliver instruction in the midst of an unresolved technological shutdown of Springfield Public Schools" and would "rise to the occasion with integrity" ^[20]. The Friday professional development day was the district's answer to that: a working day for staff to establish which systems still function and which materials have to be rebuilt from scratch ^[21].