Ransomware attack knocks out Rockford Public Schools network

Rockford Public Schools, a district in Kent County, Michigan, was hit by a ransomware attack on the morning of 15 May 2024. Superintendent Steve Matthews said he was handed a printed note shortly after 6:30 am, after ransom messages emerged from printers in several district buildings.

"Your data is stolen and encrypted," the note read, warning that the data would be published on darknet sites if no payment was made and stating that the attackers were not politically motivated and wanted only money. The district did not disclose the amount demanded, and no group publicly claimed the attack.

Rockford shut down its computer network, landline phones and Wi-Fi as a precaution, leaving every building without internet and internal phone service. Classes went ahead. Matthews told families the day would be "more old school than typical," with students and staff working from books and paper, and the district activated emergency phones so buildings could still be reached.

The district brought in the FBI, the Kent County Sheriff's Office and an outside security firm. Matthews said within about 24 hours that the incident had been isolated and contained, and by 16 May teachers had regained access to most of their usual devices. Rockford did not say at the time whether any student or staff data had in fact been taken.