Sumner County Schools (TN) Network Intrusion Delays 2026-27 School Year, Scope of Data Exposure Still Undetermined

Key facts for Sumner County Schools breach

Detection coverage for Sumner County Schools breach

As of 2026-08-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1824 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Post-Compromise Data Staging, C2 Beacon & Web-Service Exfiltration with Inhibit-Recovery Staging (K-12 Double-Extortion Pattern)

Detects the double/triple-extortion sequence CISA identifies as the dominant K-12 ransomware/data-breach pattern: local archive creation over files matching student/staff PII naming patterns, an outbound POST to a newly-seen or uncommon web destination shortly after archive staging, remote-service lateral-movement logons, and vssadmin/wbadmin shadow-copy or backup-catalog deletion consistent with inhibit-system-recovery staging ahead of ransomware deployment. Two or more signals co-occurring within a 10-minute window on the same host/segment indicate an active exfiltration-then-impact sequence. Referenced as sector-context for TL-2026-1824 (Sumner County Schools network intrusion); no confirmed data-exfiltration or encryption method has been disclosed for that specific incident as of the forensic-audit-pending public statement.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1005, T1071, T1567, T1021, T1489, T1490
• Data sources: sysmon (file_create EventID 11, process_creation EventID 1), proxy_web_logs, windows_security_eventlog (EventID 4624 LogonType 3)
• Severity: critical
• Confidence: medium

Splunk SPL

`comment("TL-2026-1824: correlates archive staging, uncommon-destination web POST, lateral remote-service logon, and vssadmin/wbadmin inhibit-recovery within 10m - K-12 double-extortion exfil/impact staging")`
| multisearch
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 (TargetFilename="*.tar.gz" OR TargetFilename="*.zip")
      | eval signal="archive_staged" ]
    [ search index=proxy sourcetype="proxy:access" cs_method=POST (uri_path="*/upload*" OR uri_path="*/beacon*")
      | eval signal="web_post_uncommon_dest" ]
    [ search index=wineventlog sourcetype="WinEventLog:Security" EventCode=4624 Logon_Type=3
      | eval signal="lateral_remote_service_logon" ]
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\vssadmin.exe" OR Image="*\\wbadmin.exe") (CommandLine="*delete shadows*" OR CommandLine="*delete catalog*")
      | eval signal="inhibit_recovery" ]
| bin _time span=10m
| stats count values(signal) as signals dc(signal) as signal_diversity values(dest) as dest_hosts by _time, ComputerName
| where signal_diversity >= 2
| table _time ComputerName signals signal_diversity dest_hosts
| sort - _time

Microsoft KQL

// TL-2026-1824: correlates archive staging, uncommon web POST, lateral logon, and inhibit-recovery commands within 10m
let window = 10m;
DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName endswith ".tar.gz" or FileName endswith ".zip"
| project Timestamp, DeviceName, Signal = "archive_staged"
| union (
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where ActionType == "HttpConnectionOutbound" and (Url has "/upload" or Url has "/beacon")
    | project Timestamp, DeviceName, Signal = "web_post_uncommon_dest"
), (
    DeviceLogonEvents
    | where Timestamp > ago(24h) and LogonType == "Network"
    | project Timestamp, DeviceName, Signal = "lateral_remote_service_logon"
), (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName in~ ("vssadmin.exe", "wbadmin.exe") and (ProcessCommandLine has "delete shadows" or ProcessCommandLine has "delete catalog")
    | project Timestamp, DeviceName, Signal = "inhibit_recovery"
)
| summarize Signals = make_set(Signal), SignalCount = dcount(Signal) by DeviceName, bin(Timestamp, window)
| where SignalCount >= 2
| sort by Timestamp desc

Sigma

title: Archive Staging Followed by Outbound POST to Uncommon Host (Exfiltration Over Web Service)
id: 3a9f6c4d-7e2b-4f1a-9c8d-000018240003
status: experimental
description: Detects local creation of a compressed archive (.tar.gz/.zip) followed within 10 minutes by an outbound HTTP POST to an uncommon or newly-seen destination path, matching the double-extortion data-staging-then-exfiltration sequence CISA documents as the dominant K-12 ransomware/data-breach pattern (AA20-345A, AA22-249A). Referenced as sector-context for TL-2026-1824 (Sumner County Schools network intrusion); no confirmed data-exfiltration method has been disclosed for that specific incident as of the forensic-audit-pending public statement.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-345a
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-249a
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-03
tags:
    - attack.collection
    - attack.t1005
    - attack.command-and-control
    - attack.t1071
    - attack.exfiltration
    - attack.t1567
    - attack.lateral-movement
    - attack.t1021
    - attack.impact
    - attack.t1489
    - attack.t1490
    - attack.tool.vice_society
logsource:
    category: proxy
detection:
    file_stage:
        TargetFilename|endswith:
            - '.tar.gz'
            - '.zip'
    web_post:
        cs_method: POST
        c_uri|contains:
            - '/upload'
            - '/beacon'
    timeframe: 10m
    condition: file_stage and web_post
falsepositives:
    - Legitimate backup software creating compressed archives and posting them to an approved backup/cloud-storage endpoint
    - SaaS/EdTech vendor integrations (e.g. a sanctioned SIS cloud-migration window) legitimately POSTing bulk data archives to a new vendor endpoint
level: critical

Known false positives:

• Legitimate backup software creating compressed archives and posting them to an approved backup/cloud-storage endpoint
• IT-scheduled vssadmin/wbadmin maintenance jobs (e.g. shrinking shadow-copy storage) outside a compromise context
• SaaS/EdTech vendor integrations (e.g. the disclosed Skyward cloud migration) legitimately POSTing bulk data archives to a new vendor endpoint during a sanctioned migration window

Tuning notes: Maintain an allowlist of approved backup/vendor destinations (including any active cloud-migration endpoints, e.g. a Skyward-style SIS transition) to suppress expected large POST/archive activity during sanctioned migration windows; require the vssadmin/wbadmin deletion signal to co-occur with an unapproved-destination POST or lateral-logon signal before escalating to critical severity; tune the archive-filename PII-pattern match list to the district's actual student/staff record naming conventions.

• 🔒 K-12 External-Facing Brute-Force Burst Culminating in Valid-Account Logon (RaaS Initial Access) · unlock with TL Creds
• 🔒 PrintNightmare-Pattern Spoolsv.exe Privesc with RaaS Persistence Account Creation & Process Masquerading · unlock with TL Creds
• 🔒 Post-Compromise Data Staging, C2 Beacon & Web-Service Exfiltration with Inhibit-Recovery Staging (K-12 Double-Extortion Pattern) · unlock with TL Creds
• 🔒 K-12 External-Facing Brute-Force Burst Culminating in Valid-Account Logon (RaaS Initial Access) · unlock with TL Creds
• 🔒 PrintNightmare-Pattern Spoolsv.exe Privesc with RaaS Persistence Account Creation & Process Masquerading · unlock with TL Creds
• 🔒 Post-Compromise Data Staging, C2 Beacon & Web-Service Exfiltration with Inhibit-Recovery Staging (K-12 Double-Extortion Pattern) · unlock with TL Creds
• 🔒 K-12 External-Facing Brute-Force Burst Culminating in Valid-Account Logon (RaaS Initial Access) · unlock with TL Creds
• 🔒 PrintNightmare-Pattern Spoolsv.exe Privesc with RaaS Persistence Account Creation & Process Masquerading · unlock with TL Creds

Indicators of compromise for Sumner County Schools breach

As of 2026-08-02, Threadlinqs Intelligence tracks 20 indicators of compromise for TL-2026-1824.

How Sumner County Schools breach works

As of August 2, 2026 the district still cannot confirm what information, if any, was compromised.

On July 20, 2026, IT staff at Sumner County Schools (Gallatin, TN — a district of roughly 31,000 students across 53 schools, north of Nashville) discovered unauthorized access to the district's network. The district "promptly notified local and federal law enforcement and the [Tennessee] Department of Education" and engaged third-party forensic specialists. The intrusion disrupted core network communications severely enough that the July 21 Board of Education meeting livestream was not published, and the district revised its academic calendar: new-student registration moved from July 22 to August 4-5, and the first day of the 2026-27 school year moved from August 4 to August 10 (kindergarten phase-in further staggered by last name: A-L on Monday/Wednesday, M-Z on Tuesday/Thursday, no Friday sessions).

Superintendent Dr. Scott Langford stated the district's team was "working around the clock to minimize the impacts to schools and overall operations" and that scheduled sporting events were not expected to be affected. District officials later confirmed the district's network was restored over the weekend following discovery (on or about July 27-28), and that the Skyward student information system, school nutrition systems, payroll systems, and student iPads/Chromebooks were NOT affected by the incident. Notably, days before the breach was discovered, parents had been notified of a state-mandated cloud transition of the Skyward platform; the district has not confirmed or denied any connection between that migration and the intrusion.

As of the August 2, 2026 update (the most recent public statement, from Chief of Staff Jeremy Johnson), the district says it is "still sorting out" what information may have been compromised and will release verified findings once its forensic audit concludes. Officials have explicitly declined to state which computer systems were compromised, and have not disclosed whether files were encrypted, whether data was accessed or removed, or whether any ransom demand was made. No threat actor has been named or has publicly claimed responsibility, no CVE or exploited vulnerability has been disclosed, and no data has surfaced on leak sites as of this writing. The FBI, Tennessee Bureau of Investigation (TBI), and U.S. Department of Homeland Security are continuing the investigation alongside the third-party forensic team.

Independent cybersecurity consultant Christopher Warner (quoted by WKRN/Yahoo News/AOL) characterized the incident within the broader pattern of K-12 network intrusions, noting it is "not uncommon for hackers to threaten to expose personal information on the dark web" following this class of breach, and advised parents/staff to assume worst-case data exposure, watch for phishing texts/emails/calls and AI-generated impersonation attempts, and change school-related passwords. This guidance aligns with the joint CISA/FBI/MS-ISAC K-12 threat landscape: CISA reports K-12 cyber incidents occur more than once per school day on average, that Ransomware-as-a-Service (RaaS) has lowered the barrier to entry for attackers, and that double/triple-extortion (steal-then-threaten-to-leak) is now the dominant K-12 ransomware pattern, with only ~5% of districts reporting MFA on student accounts despite 1-in-4 districts seeing increased attacks on those accounts. Two specific joint CISA advisories document the sector's typical attacker tradecraft and are used below purely as SECTOR-CONTEXT, not as confirmed facts about this intrusion: (1) AA22-249A (#StopRansomware: Vice Society) — the FBI/CISA/MS-ISAC's highest-profile education-sector ransomware actor, responsible for ~40% of its victims being schools, which gains initial access via compromised credentials and exploitation of internet-facing applications and has been observed exploiting the PrintNightmare privilege-escalation vulnerability (CVE-2021-34527), deploying Hello Kitty/Five Hands/Zeppelin ransomware variants; and (2) AA20-345A (Cyber Actors Target K-12 Distance Learning Education) — documenting DDoS-for-hire disruption of school online services, video-conference ('Zoom-bombing') hijacking, the Shlayer macOS trojan downloader (distributed via fake Adobe Flash updaters), and social-engineering/phishing against students, parents, faculty, and IT staff as recurring K-12 attack patterns. No specific technique, malware family, or infrastructure item below is confirmed as used against Sumner County Schools; entries reflect either facts explicitly stated by the district/investigators or the documented, CISA-sourced sector-typical pattern for this incident category (K-12 network intrusion / suspected data breach), clearly distinguished in context on each entry.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Discovery

T1018 Remote System Discovery

Lateral Movement

T1021 Remote Services

Defense Evasion

T1036 Masquerading

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071 Application Layer Protocol

Initial Access

T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application; T1566 Phishing

Credential Access

T1110 Brute Force

Persistence

T1136 Create Account

Execution

T1204 User Execution

Impact

T1486 Data Encrypted for Impact; T1489 Service Stop; T1490 Inhibit System Recovery; T1498 Network Denial of Service

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1583 Acquire Infrastructure

Reconnaissance

T1589 Gather Victim Identity Information

reconnaissance

T1598 Phishing for Information

Remediation for Sumner County Schools breach

Immediate actions

• Assume worst-case exposure of student/staff personal data pending forensic audit results (per independent cybersecurity consultant guidance)
• Change all school-related account passwords (staff, parent portal, student accounts)
• Monitor for phishing texts, emails, and phone calls referencing the district or the breach, including AI-generated voice/text impersonation attempts
• Confirm reported-unaffected systems (Skyward SIS, nutrition, payroll, student devices) remain isolated/verified clean before fully trusting them
• Preserve logs and forensic artifacts for the FBI/TBI/Homeland Security/third-party forensic investigation

Workarounds

• Manual/paper-based enrollment and registration procedures while core network communications remain under investigation
• Delayed/staggered school start and kindergarten phase-in to allow verification of restored systems before full operations resume

Longer-term hardening

• Enforce multi-factor authentication (MFA) on all staff and student accounts; CISA notes only ~5% of K-12 districts currently protect student accounts with MFA
• Segment core network communications infrastructure from student information, payroll, and nutrition systems so a single intrusion cannot cascade
• Conduct incident response tabletop exercises and maintain tested offline backups per CISA K-12 ransomware guidance
• Review third-party EdTech/vendor (e.g., cloud SIS platform) access and supply-chain exposure, particularly around vendor-driven migrations
• Adopt CISA StopRansomware K-12 reference materials as a standing control baseline
• Close/restrict exposed RDP (3389) and SMB (445) services and disable unused internet-facing management interfaces, per CISA/FBI/MS-ISAC guidance on the most common ransomware initial-access vector
• Patch privilege-escalation vulnerabilities such as PrintNightmare (CVE-2021-34527) promptly; Vice Society and similar education-sector ransomware actors are documented exploiting unpatched local-priv-esc bugs post-compromise
• Enable waiting-room/passcode controls on video-conferencing platforms to mitigate 'Zoom-bombing' style hijacking documented against K-12 distance-learning services

Affected and fixed versions

• Sumner County Schools — District network / core network communications infrastructure
  Vulnerable versions: Unknown - scope still under forensic audit as of 2026-08-02
  Fixed in: Network reported restored on or about 2026-07-27/28
• Skyward, Inc. — Skyward Student Information System (SIS)
  Fixed in: Confirmed by district as NOT affected by the incident; unrelated state-mandated cloud transition was underway days before the breach

Timeline of Sumner County Schools breach

• 2026-07-18 Days before the breach was discovered, locked-ioc-16 parents were notified of a state-mandated cloud transition of the Skyward student information system; the district has not confirmed or denied any connection to the subsequent intrusion.
• 2026-07-20 locked-ioc-16 IT staff discover unauthorized access to the district network.
• 2026-07-21 Superintendent locked-ioc-17 publicly confirms the district promptly notified local and federal law enforcement and the locked-ioc-14, and engaged third-party forensic specialists.
• 2026-07-21 The July 21 Board of Education meeting is held; its livestream video is disrupted and not published to the district website, and a revised academic calendar is discussed.
• 2026-07-22 District announces new-student registration is postponed from July 22 to August 4-5, and the first day of the 2026-27 school year is moved from August 4 to August 10, with kindergarten phase-in staggered by student last name.
• 2026-07-23 Independent cybersecurity consultant locked-ioc-18 publicly advises parents/staff to assume worst-case data exposure, watch for phishing and AI-generated impersonation attempts, and change school-related passwords.
• 2026-07-25 Local reporting (NewsChannel5) notes families still lack answers roughly a week after the intrusion was discovered; officials have not said which computer systems were compromised or whether files were encrypted, accessed, or removed.
• 2026-07-27 District network is restored over the weekend following the initial breach discovery.
• 2026-07-31 District confirms the Skyward SIS, school nutrition systems, payroll systems, and student iPads/Chromebooks were NOT affected by the incident; FBI, TBI, and Homeland Security continue investigating alongside the third-party forensic team.
• 2026-08-02 Chief of Staff locked-ioc-19 provides a limited public update: the district is still sorting out what information may have been compromised; verified findings will be released once the forensic audit concludes.

Sources cited for Sumner County Schools breach

• Ransomware Reference Materials for K-12 School and School District IT Staff CISA · Advisory · 2026-01-01
• Cybersecurity for K-12 Education | CISA CISA · Advisory · 2026-01-01
• #StopRansomware: Vice Society (AA22-249A) CISA · Advisory · 2022-09-06
• Cyber Actors Target K-12 Distance Learning Education to Cause Disruptions and Steal Data (AA20-345A) CISA · Advisory · 2020-12-10
• Sumner County Schools provides limited update on data breach mainstreetmediatn.com · News · 2026-08-02
• TN Sumner County Schools provides limited update on data breach databreaches.net · News · 2026-08-02
• Data breach delays start of Sumner County school year wpln.org · News · 2026-07-22
• Sumner County Schools delays start of year after network data breach wsmv.com · News · 2026-07-22
• Sumner County Schools' network restored after data breach delays start of school year. Here's what you need to know wsmv.com · News · 2026-07-31
• Sumner County, TN Schools delays start of school year due to network breach wkrn.com · News · 2026-07-22
• Cybersecurity expert weighs in on Sumner County Schools network breach yahoo.com · News · 2026-07-23
• Cybersecurity expert weighs in on Sumner County, TN Schools network breach wkrn.com · News · 2026-07-23
• Sumner County Schools delays start of year after network breach, families still search for answers newschannel5.com · News · 2026-07-25
• Sumner County Schools delays opening after network breach in Tennessee dysruptionhub.com · News · 2026-07-22

More in data breach

• Chainalysis breach via agentic on-path (AitM) attack exposes user credentials and live authentication tokens
• DreamHost Data Breach via Third-Party File Manager Flaw Exposes FTP/SFTP and Webmail Credentials
• WorkOS Internal Sales App Breached by Attacker Using ARTEX AI Offensive Framework
• Frontline Education Data Breach via Third-Party Software Vulnerability Impacts Over 1.3 Million People
• Chainalysis Confirms Cyberattack: Unauthorized Access to Internal Tools via 'Offensive Agentic Techniques' Exposes Customer Account Data

Previous and next in data breach

• Alleged Żabka Polska Breach: 541K Jira Issues, 230K IT Tickets, 89 GitLab Repos, and Cloudflare/MongoDB/Broker Credentials Offered for €5,000 Next report