‘Cybersecurity incident’ affects CCSD email, sparking investigation, precautions

Teachers expressed frustration Tuesday, a day after the Clark County School District discovered it was the target of a “cybersecurity incident impacting its email environment.”

Ryan Fromoltz, a media and English teacher at Harney Middle School, said he wasn’t able to do anything that involved a computer with his middle school students Tuesday.

That’s because his students couldn’t change their passwords — the change required as part of new security measures from the Clark County School District following Monday’s cybersecurity incident.

“As a media teacher, this is horrible for me,” Fromoltz said. “I depend on technology.”

The school district announced Monday night that it was affected by a “cybersecurity incident impacting its email environment.” In an email to parents, the district said the incident occurred around Oct. 5 and a “comprehensive assessment” is ongoing.

In a follow-up email Monday, the district also announced it’s taking security measures such as temporarily limiting access to Google Workspace to within the district’s internal network — meaning it is accessible in schools and administrative buildings — and implementing a forced password change for students.

High school history teacher Robert Cowles said Tuesday that the cyberattack had a small impact on him.

Cowles said he can’t access school emails from home, so he has to wait until he gets to work at 6 a.m. to see any that come in after he leaves campus for the day.

“The big problem was the reset of students’ passwords,” he wrote in a message to the Las Vegas Review-Journal. “Most students couldn’t get access to create new passwords, so they were offline all day. They can’t access Google Docs, so there are more barriers for students when turning in work.”

Cowles noted that for him not being able to access emails outside of work is a temporary inconvenience.

“The only real problem I have with this is that CCSD didn’t tell us our data was stolen for 11 days,” he wrote. “We should have been made aware immediately.”

CCSD, the nation’s fifth-largest district with nearly 300,000 students, didn’t immediately respond to a Review-Journal request for an update Tuesday afternoon.

‘Limited personal information’ of small group accessed

An investigation by forensic experts discovered that an unauthorized party accessed “limited personal information” related to a small group of students, parents and employees, according to the message.

The district said it’s working to identify everyone whose information was affected and noted that a comprehensive investigation may take several weeks to complete.

No reports of identity theft had been made to the district as of Monday, according to the message.

“Rest assured that we are committed to sharing more information as it becomes available in the coming weeks,” the district wrote in the email.

People with concerns or questions can call the district’s assistance line at 888-566-5512 between 6 a.m. and 6 p.m. Monday through Friday.

Nevada Learning Academy, the district’s online school, has a notice on its website dated Tuesday saying the district has limited the access to Google Workspace for the next five days.

“Unless students/teachers/staff are in a CCSD building, they cannot access their accounts at this time,” according to the notice. “At this point in time, we are awaiting more information.”

Districtwide, students will continue to have access to Canvas and Infinite Campus once their password has been reset, the district wrote in the Monday night message to parents.

‘Kids can’t get in and do their work’

Fromoltz said using lesson plans was unfeasible Tuesday for most of the teachers he spoke with.

He said his students were trying to reset their passwords but didn’t have much luck because the district website they needed to use was overloaded and wasn’t working.

If students can’t get into programs, they can’t do anything, Fromoltz said.

“This can really have a huge effect on my curriculum and will destroy some projects and assignments we had planned because kids can’t get in and do their work.”

And off campus, teachers can’t grade or answer emails, he said, and students can’t do anything.

Elementary school reading teacher Vicki Kreidel, president of the National Education Association of Southern Nevada, said the situation was unfortunate.

“Many educators complete their professional responsibility tasks at home, especially if they need to be home with their families in the evening and on weekends,” she wrote in a Tuesday message to the Review-Journal.

Administrators will have to be more understanding of this for now until the Google Workspace is secured again, wrote Kreidel, who teaches at Heard Elementary School.

“I think students being unable to access CCSD sites at home is a problem, too,” she wrote. “That could mean educators have to allow more time for students to do their work.”

Not the first cyberattack

It’s not the first cyberattack that has affected the district. A ransomware attack occurred during the first week of school in 2020 — an incident that drew national attention.

The district said at the time that some data about current and former employees may have been compromised.

A hacker group claimed it uploaded stolen information — including employee names and Social Security numbers as well as student names and grades — to its website after the district refused to pay a ransom.

The district used backups to restore its systems.

Cowles said Tuesday that he froze his credit a few years ago after data was compromised.

“Now there are a whole new group of people who must be vigilant about their credit and personal information,” he wrote.

The cybersecurity incident is going to endanger a lot of people, Fromoltz said, calling it “very scary.” He also said the district needs to address its technology infrastructure.

The district, he said, needs to show the public and reassure them that this is the last time something like this is going to happen.

Contact Julie Wootton-Greener at jgreener@reviewjournal.com or 702-387-2921. Follow @julieswootton on X. Digital content producer Taylor Lane contributed to this report.