Spokane Public Schools Cybersecurity Incident: Student and Staff Data Now Believed To Be Compromised

On October 8, Spokane Public Schools notified families that it now has reason to believe student and staff data was compromised. The investigation remains ongoing, and the district is still determining exactly what information may have been affected.

Updated: 10/09/2026 @ 9:30am | Author: Zach Carothers | Reviewed by: Benjamin Ross

Executive Summary

Spokane Public Schools has entered a new phase of its investigation into the network security incident that was first detected on September 20.

On October 8, the district notified families that it now has reason to believe student and staff data was compromised. Third-party cybersecurity specialists are still working with the district’s IT team to determine exactly what information may have been affected, and SPS says it will communicate directly with impacted individuals once those details are verified.

That is the most significant development since the incident began.

PowerSchool, BusinessPlus and other major systems have been restored, but the investigation isn’t over by a long shot. The district hasn’t publicly disclosed what specific data was affected, how many people may be impacted, whether information was actually exfiltrated, how the bad guys gained access in the first place, or who was responsible.

This article will continue to be updated as Spokane Public Schools releases verified information.

This Is Still Very Close to Home

For us, this one’s too close to home in the most literal sense.

TorchLight is headquartered in Liberty Lake, and Spokane, Spokane Valley, Liberty Lake and Coeur d’Alene aren’t just cities we added to a service-area map. This is our home. Our employees live here, our families live here, and a lot of our clients and friends live here.

When Spokane Public Schools first disclosed that it was responding to a network security incident in September, our approach was intentionally cautious. At the time, systems were offline, the investigation had only begun and there was no verified basis to say student information had been compromised, yet.

However, that has since changed.

What Spokane Public Schools Told Families on October 8

On Thursday, October 8, Spokane Public Schools sent a notification directly to its community stating:

“While the network security investigation remains ongoing, we have reason to believe that student and staff data was compromised.”

The district said third-party cybersecurity specialists are continuing to work with its IT team to determine what specific information may have been affected. SPS also told families that this process will take time and that impacted individuals will be contacted once details are verified so the district can provide any necessary next steps.

Independent reporting from The Spokesman-Review, KREM and KXLY confirmed the same claim.

This notification represents a serious change from the district’s earlier public statements. The concern isn’t simply whether personal information may have been involved anymore. SPS now says it has reason to believe student and staff data was compromised, which we were hoping we wouldn’t see.

OCTOBER 8 DISTRICT NOTIFICATION

Spokane Public Schools October 8 data compromise notification sent to families — Spokane Public Schools notification sent to families on October 8, 2026, stating that the district has reason to believe student and staff data was compromised.

What We Know Right Now

The incident was detected on September 20, after which Spokane Public Schools took several systems offline while it investigated. PowerSchool and BusinessPlus, the district’s finance, HR and payroll platform, were all affected early in the response.

PowerSchool access was later restored for staff, followed by parents and students on September 30. The district warned at the time that some grades, attendance records and other information could take several days to synchronize because teachers and staff had been using manual processes while systems were unavailable.

BusinessPlus has also been restored, meaning the most noticeable operational disruption has largely passed.

But operational recovery and forensic recovery are not the same thing.

SPS continues to work with outside cybersecurity specialists to determine the scope of the incident. As of October 8, the district had not provided an estimate for when that investigation would be complete.

What We Still Do Not Know

The October 8 notification answers one of the biggest questions surrounding this incident, but it creates several new ones.

Spokane Public Schools has not publicly identified exactly what student or staff information was affected. The district has not announced how many people may be impacted, whether the affected information was actually removed from district systems, whether Social Security numbers, financial information, medical information or credentials were involved, or whether different groups of students and employees experienced different levels of exposure.

The district has also not publicly disclosed the initial point of entry, confirmed ransomware involvement or attributed the incident to a specific threat actor.

“Data was compromised” does not automatically tell us what data was involved, whether it was viewed, copied or exfiltrated, or what risk an individual student or employee may face.

Those answers normally depend on the forensic investigation that is still underway.

What Families and Staff Should Do Now

For parents, employees and students, the most important thing right now is to watch for direct communications from Spokane Public Schools.

SPS has said it will contact impacted individuals once the affected information has been verified. Until that happens, families should be cautious about emails, text messages or phone calls claiming to have information about the incident, especially messages asking for passwords, financial information or urgent account action.

Events like this can create an opportunity for phishing because the bad guys don’t necessarily need access to the original stolen data to take advantage of public concern surrounding the incident.

Using unique passwords, enabling multi-factor authentication wherever it is available and being skeptical of unexpected messages are reasonable precautions while the investigation continues.

Why This Matters Beyond Spokane Public Schools

One of the clearest lessons from the last several weeks is that cybersecurity incidents rarely remain isolated to the IT department.

For more than a week, Spokane Public Schools dealt with unavailable systems, manual attendance processes, delayed access to grades and administrative disruption while investigators worked behind the scenes. Now the district has moved from system recovery into the more difficult question of determining what information was affected and who needs to be notified.

That progression is relevant to nearly every organization that holds sensitive information.

A strong incident response plan needs to account for more than getting systems back online. Organizations also need to know how they will preserve evidence, involve outside specialists, determine whether information was compromised, communicate with affected people and meet any legal or regulatory obligations that follow.

For Washington school districts, we maintain a dedicated Washington K-12 Cybersecurity Compliance Checklist covering incident response, access controls, recovery and other cybersecurity requirements.

The Technical Side

There is still one unverified detail worth acknowledging.

On September 21, the NightSpire ransomware/extortion group listed an organization identified only as “Spo**** Schools” on its leak site. Multiple ransomware-monitoring services captured the listing, but the posting did not identify a domain, provide a data volume or publish information that independently establishes that the target was Spokane Public Schools. Also, Spokane Public Schools has not publicly attributed the incident to NightSpire.

Because of that, we are not treating the listing as confirmation that NightSpire was responsible, that ransomware was deployed or that the group obtained Spokane Public Schools data.

The October 8 notification from SPS is significant because it comes from the district itself and is based on the ongoing investigation. It confirms the district now has reason to believe student and staff data was compromised, but it does not yet establish the attack method, the people responsible, or exact scope of the affected information.

We Will Keep This Updated

This investigation is not finished.

The next meaningful developments will likely involve the specific information affected, the number of students or staff impacted, direct notifications to those individuals, the cause of the incident or additional findings from the forensic investigation.

As Spokane Public Schools releases meaningful, verified information, we will continue updating this article throughout the investigation, recovery and notification process.

There will always be plenty of people willing to turn a developing cybersecurity incident into a dramatic headline.

We would rather help our community understand what is actually known, what is still being investigated and what matters next.

Questioning your own organization’s readiness?

If this incident has you taking a harder look at your own environment, talk with our local TorchLight team.

Talk With Our Local Team Washington K-12 Checklist