The Concord Public Schools and Concord-Carlisle Regional School District were recently hit with a cyber attack, Superintendent Laurie Hunter told families over the weekend.
“It is clear now that we are victims of a cyber security attack that included a ransom file,” Hunter said in her Sunday letter, which school officials provided Tuesday. “There are a lot of moving pieces, and information has been continually evolving.”
School officials said they had no comment beyond Hunter’s letter, and police couldn’t immediately be reached for comment.
“We are working with a number of outside teams, including a forensic team, a legal team, and our insurance provider,” Hunter wrote. “Our own IT team is working 18 hours a day on the steps to identify, contain, and recover the system. As we leave the weekend, we return to a clean network environment and upgraded security software that is being pushed out to all machines.”
She said the malware affected only PCs.
“This was the most fortuitous aspect of the whole event,” Hunter wrote. “Once we established new networks at each school last week, access was safely restored for all MacIntosh devices.”
Hunter said the district’s central office was “most impacted” by the attack.
“We are working to restore essential functions and will note one impact on students beginning tomorrow,” Hunter wrote Sunday. “The cafeterias at CMS and CCHS will take cash only for snacks. With lunch being free, the meal count is adequate for the moment.”
The school also learned Sunday of the possibility of a data breach linked to the attack, according to Hunter, who stressed there was no evidence of student data being compromised.
“The investigation is ongoing. I will provide updates as I have them. I will again thank all of those who have worked tirelessly for days. As has always happened, everyone collaboratively rises to the challenge, and we work through it together,” she said.
The attack followed a prior intrusion last year into the Lawrence Public Schools computer network.
Officials said late last summer that Lawrence was trying to recover $2.7 million in funds that had been “frozen” when a staffer responded to a phishing email sent by scammers posing as a vendor for the school district.
Cyber criminals had targeted other municipalities previously, including Lowell. Last April, officials reported that a cybersecurity breach had forced the shutdown of computer servers and telephones in multiple city agencies. In May, officials said phone service had been restored to multiple city offices. Emergency 911 service was never affected.
A cybercrime organization called “Play,” believed to be based in Russia, claimed credit for the attack.
Play operates on the “dark web,” a part of the Internet that’s inaccessible to standard browsers and search services. The Play site lists Lowell among the organization’s victims, which apparently include about 75 organizations around the world, ranging from BMW’s operations in France to the sheriff’s department in Palo Alto County, Iowa.
This breaking news story will be updated when more information is released. Material from prior Globe stories was used in this report.
Travis Andersen can be reached at travis.andersen@globe.com.