Spring Lake Park Schools abruptly pulled the plug on classes across the north-metro district on Monday after its technology team detected unauthorized access to district computer systems in what officials are treating as a suspected ransomware incident. Staff took key systems offline to block further access, which in turn led the district to cancel child care, community education, and after-school programs for the day. Families and staff were told to watch for ongoing updates as outside cybersecurity specialists and law enforcement began digging into what happened.
According to the district, the technology team confirmed on Sunday that someone had gained access to some district systems, and staff "shut down all systems to prevent further access, including systems required to safely have school," as reported by KSTP. The outlet reports that the district is working with third-party cybersecurity experts and law enforcement to restore systems and plans to provide an update on Monday. The closure affects students districtwide and has disrupted activities that were scheduled to take place in school buildings.
The district’s system-status site is currently showing multiple service warnings and outages, including a notice that some users "may be unable to access archived email messages in Outlook on the web" and a Panther Help Desk timeout, with time-stamped updates posted early Monday morning, according to the Spring Lake Park Schools system status page. The page lists last updates around 1:33 to 1:34 a.m. and notes that technicians are investigating, reaching out to affected users, and working toward a resolution. The posts indicate the disruption reaches beyond classroom devices and into email and support tools used by families and staff.
What families should know
Parents are being advised to brace for at least one more day without in-person classes and to expect slowdowns in district email and help-desk responses as technicians and outside consultants work through the outage, according to KSTP. The district’s main phone line, 763-600-5000, is available for urgent questions, and officials say updates will be shared on the district website and status page. Families with child care or community education registrations affected by the closure should watch for separate messages from program providers about potential refunds or rescheduling.
Why schools are targets
Ransomware groups have increasingly zeroed in on K–12 districts, which hold large amounts of student and staff data but often lack the deep security budgets of big companies. The U.S. Department of Education points districts to federal reporting and response resources and maintains K–12 cybersecurity guidance, while CISA offers dedicated stop-ransomware guidance for schools. Those agencies, along with industry reports, emphasize that quickly isolating an incident and bringing in outside specialists are critical steps in recovering from an attack.
Legal implications
If investigators conclude that personal data were accessed, Minnesota law requires the district to notify affected individuals and, in some situations, state authorities and consumer reporting agencies. Minn. Stat. § 325E.61 mandates notice "in the most expedient time possible and without unreasonable delay," and government entities have a related reporting duty under Minn. Stat. § 13.055. Both statutes allow law enforcement to request delays in notification while an active investigation is underway. Parents are being encouraged to keep an eye out for any legally required notices from the district if officials confirm that personal data were compromised.
The district has said it will provide an update on Monday, and families and staff are being urged to check the district homepage and system-status page for the latest official information as technicians and law enforcement continue efforts to restore normal operations.
