Jerome School District Cyberattack Closes Campuses
Threat actors no longer need to encrypt classroom computers to disrupt academic instruction. In Idaho, cybercriminals seized control of connected security cameras, electronic door locks, and heating systems. Consequently, the Jerome School District cyberattack forced administrators to cancel classes across all campuses for two days. This unexpected shutdown left approximately 4,000 students at home.
Compromised Building Infrastructure Threatens Campus Safety
The network intrusion began on October 17, when internal monitoring systems detected anomalies. Furthermore, faculty members reported widespread connection outages across district offices. As superintendent Brent Johnson confirmed, the intruders breached both administrative servers and operational technology. Specifically, attackers accessed smart building equipment that manages physical facility security.
The breach directly compromised surveillance cameras, electronic access doors, and HVAC climate controls. Fortunately, officials found no evidence that attackers locked classroom doors or manipulated internal temperatures maliciously. Nevertheless, administrators could not guarantee physical safety while unauthorized parties held remote access. Therefore, leadership closed all eight district schools on October 19 and 20. Additionally, administrators rescheduled parent-teacher conferences to ensure student welfare.
Ransom Demands and Ongoing Forensic Recovery
The intrusion involved explicit financial extortion demands. According to local reporting on the Jerome schools cyberattack, the hackers claimed they exfiltrated sensitive files and demanded a ransom. However, district officials declined to specify the ransom amount. Similarly, leadership refrained from disclosing whether they would negotiate with the extortionists.
Restoring Systems and Mitigating Exposure
Technical teams worked continuously to sanitize compromised network segments. Fortunately, existing perimeter defenses successfully restricted unauthorized movement through critical databases. Consequently, administrators believe that most student records remained protected throughout the incident. Meanwhile, forensic specialists are inspecting all staff devices before reconnecting them to local networks. Law enforcement agencies also joined the active investigation.
Notably, this security crisis represents the second breach affecting Jerome schools in recent years. In December 2024, a major breach targeting PowerSchool exposed records belonging to staff and students. However, this latest incident illustrates an alarming shift toward operational technology extortion. Modern cybercriminals now weaponize connected facilities to paralyze entire physical campuses.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
