Highline Public Schools confirms cyber security incident was a form of ransomware

Highline Public Schools has confirmed unauthorized activity it discovered on September 7 was a form of ransomware, according to a news release from the district on Thursday.

It also stated the FBI is continuing to investigate and the district “cannot comment on any potential law enforcement investigation at this time.” Law enforcement is also still working to figure out what personal information was involved.

Port of Seattle: Outage was ransomware attack; ransom hasn’t been paid

The district said it is providing all Highline employees with free credit monitoring for one year.

“We have chosen to provide staff with this service as a precaution and accommodation,” the district stated.

Highline added that if the investigation reveals personal information was exposed, it will notify those individuals in writing, following applicable law.

Highline schools reopened on Thursday, September 12, but operations looked a little different. There was no internet access as the district continued to investigate the cyber security incident.

Highline Public Schools, located in South King County, announced the plan to reopen via its website.

“The investigation is still ongoing,” the district stated. “We want to be clear, this incident involved our digital network, and not the physical safety of our facilities. Student safety measures remain in place. We will provide updates related to the incident as they become available.”

Highline said it was working on a plan for Highline Virtual Academy and the Highline Virtual Elementary program, which rely on virtual learning.

Schools were closed the previous three days, delaying the first day of kindergarten and affecting athletics. With the new plan, athletics were able to resume. The district said school clubs and activities would start back up on a case-by-case basis.

“We’re working with our before- and after-school providers—please look for communication from your provider about programming,” Highline stated.

The district said as a precaution, it took certain systems offline which were vital for school operations. However, according to a news release, Office 365, including email and the district’s website was operational.

“Our investigation into unauthorized activity on our technology systems is ongoing, and critical systems are still offline,” Highline stated. “We have not seen evidence of staff, family or student information compromised. If this changes, we will notify impacted individuals.”

Highline Superintendent Ivan Duran posted a statement, acknowledging families’ disappointment in postponing the first day of kindergarten.

“My oldest son was set to begin kindergarten in Highline today,” Duran wrote. “Like many of you, we were eagerly looking forward to this new chapter.”

Gee and Ursula: What does it take to get fired as a Mercer Island police officer?

During the closures, the central office stayed open. School and central office administrators were still expected to report to work. Staff were being asked not to use their district-issued computer and laptops until further notice.

Editors note: This story was originally published on September 8. It has been updated and republished since then.

Julia Dallas is a content editor at MyNorthwest. You can read her stories here. Follow Julia on X here and email her here.