Spring Lake Park schools extend ransomware closure, target Wednesday restart

Spring Lake Park Public Schools in Minnesota canceled classes after a suspected ransomware attack and announced the district will remain closed Tuesday while targeting a restart on Wednesday, April 15. District officials said response teams have worked “night and day” since Sunday to isolate systems and must fully test phones, building security and other safety systems before students and staff return. While high school sports and activities were still scheduled for Tuesday afternoon, districtwide testing programs were disrupted — the ACT administered in the district has been pushed to April 21 and state MCA testing will be rescheduled as needed — and officials promised another public update by mid‑afternoon Tuesday if the reopening plan changes.

Context from broader data underscores why the closure is consequential: Spring Lake Park serves a diverse student body (about 47% White, 14.9% Black, 8.9% Asian, and 19.5% Hispanic/Latino) with roughly 42% of students economically disadvantaged, meaning disruptions can have outsized effects on families who rely on school services. Educational institutions commonly face these incidents; exploited security vulnerabilities account for about 21% of successful ransomware attacks on schools, and the average ransomware‑related school closure runs about 2.5 days — making the district’s Wednesday target in line with historic averages, though each incident’s impact varies based on which systems are affected.

Public reaction and on‑the‑ground reporting have amplified the story: cybersecurity trackers and analysts documented the incident as occurring around April 12, and local commenters and candidates highlighted the broad community impact when district safety services and communications are affected. Observers urged attention to systemic security gaps, while some residents criticized the handling as symptomatic of larger problems in public education. The narrative has shifted from an initial notice of a cancellation to more detailed follow‑ups driven by local reporting: early coverage simply reported classes canceled, while the follow‑up from the same outlet provided a concrete timeline for reopening, detailed the technical and safety checks required, and spelled out the knock‑on effects for testing and activities.