# Sumner County Schools (TN) Network Intrusion Delays 2026-27 School Year, Scope of Data Exposure Still Undetermined

> Sumner County Schools in Tennessee discovered unauthorized access to its network on July 20, 2026, engaged the FBI, TBI, Homeland Security, the Tennessee Department of Education, and third-party forensic specialists, and delayed the start of the 2026-27 school year to August 10. As of August 2, 2026 the district still cannot confirm what information, if any, was compromised.

- **Published:** 2026-08-02T00:00:00Z
- **Last reviewed:** 2026-08-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1824
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-sumner-county-schools-breach-tl-2026-1824.webp?v=4edb507c (Threadlinqs threat intel: Sumner County Schools (TN) Intrusion: Detection & IOCs (TL-2026-1824) — Medium severity, 20 IOCs, 9 detection rules.)
- **ID:** TL-2026-1824
- **Severity:** MEDIUM
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 20

## Description

On July 20, 2026, IT staff at Sumner County Schools (Gallatin, TN — a district of roughly 31,000 students across 53 schools, north of Nashville) discovered unauthorized access to the district's network. The district "promptly notified local and federal law enforcement and the [Tennessee] Department of Education" and engaged third-party forensic specialists. The intrusion disrupted core network communications severely enough that the July 21 Board of Education meeting livestream was not published, and the district revised its academic calendar: new-student registration moved from July 22 to August 4-5, and the first day of the 2026-27 school year moved from August 4 to August 10 (kindergarten phase-in further staggered by last name: A-L on Monday/Wednesday, M-Z on Tuesday/Thursday, no Friday sessions).

Superintendent Dr. Scott Langford stated the district's team was "working around the clock to minimize the impacts to schools and overall operations" and that scheduled sporting events were not expected to be affected. District officials later confirmed the district's network was restored over the weekend following discovery (on or about July 27-28), and that the Skyward student information system, school nutrition systems, payroll systems, and student iPads/Chromebooks were NOT affected by the incident. Notably, days before the breach was discovered, parents had been notified of a state-mandated cloud transition of the Skyward platform; the district has not confirmed or denied any connection between that migration and the intrusion.

As of the August 2, 2026 update (the most recent public statement, from Chief of Staff Jeremy Johnson), the district says it is "still sorting out" what information may have been compromised and will release verified findings once its forensic audit concludes. Officials have explicitly declined to state which computer systems were compromised, and have not disclosed whether files were encrypted, whether data was accessed or removed, or whether any ransom demand was made. No threat actor has been named or has publicly claimed responsibility, no CVE or exploited vulnerability has been disclosed, and no data has surfaced on leak sites as of this writing. The FBI, Tennessee Bureau of Investigation (TBI), and U.S. Department of Homeland Security are continuing the investigation alongside the third-party forensic team.

Independent cybersecurity consultant Christopher Warner (quoted by WKRN/Yahoo News/AOL) characterized the incident within the broader pattern of K-12 network intrusions, noting it is "not uncommon for hackers to threaten to expose personal information on the dark web" following this class of breach, and advised parents/staff to assume worst-case data exposure, watch for phishing texts/emails/calls and AI-generated impersonation attempts, and change school-related passwords. This guidance aligns with the joint CISA/FBI/MS-ISAC K-12 threat landscape: CISA reports K-12 cyber incidents occur more than once per school day on average, that Ransomware-as-a-Service (RaaS) has lowered the barrier to entry for attackers, and that double/triple-extortion (steal-then-threaten-to-leak) is now the dominant K-12 ransomware pattern, with only ~5% of districts reporting MFA on student accounts despite 1-in-4 districts seeing increased attacks on those accounts. Two specific joint CISA advisories document the sector's typical attacker tradecraft and are used below purely as SECTOR-CONTEXT, not as confirmed facts about this intrusion: (1) AA22-249A (#StopRansomware: Vice Society) — the FBI/CISA/MS-ISAC's highest-profile education-sector ransomware actor, responsible for ~40% of its victims being schools, which gains initial access via compromised credentials and exploitation of internet-facing applications and has been observed exploiting the PrintNightmare privilege-escalation vulnerability (CVE-2021-34527), deploying Hello Kitty/Five Hands/Zeppelin ransomware variants; and (2) AA20-345A (Cyber Actors Target K-12 Distance Learning Education) — documenting DDoS-for-hire disruption of school online services, video-conference ('Zoom-bombing') hijacking, the Shlayer macOS trojan downloader (distributed via fake Adobe Flash updaters), and social-engineering/phishing against students, parents, faculty, and IT staff as recurring K-12 attack patterns. No specific technique, malware family, or infrastructure item below is confirmed as used against Sumner County Schools; entries reflect either facts explicitly stated by the district/investigators or the documented, CISA-sourced sector-typical pattern for this incident category (K-12 network intrusion / suspected data breach), clearly distinguished in context on each entry.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1566 Phishing
- T1133 External Remote Services
- T1190 Exploit Public-Facing Application
- T1204 User Execution
- T1136 Create Account
- T1068 Exploitation for Privilege Escalation
- T1036 Masquerading
- T1110 Brute Force
- T1018 Remote System Discovery
- T1021 Remote Services
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1567 Exfiltration Over Web Service
- T1489 Service Stop
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1498 Network Denial of Service
- T1589 Gather Victim Identity Information
- T1598 Phishing for Information
- T1583 Acquire Infrastructure

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Post-Compromise Data Staging, C2 Beacon & Web-Service Exfiltration with Inhibit-Recovery Staging (K-12 Double-Extortion Pattern)** (`TL-2026-1824-SPL-003`)

Detects the double/triple-extortion sequence CISA identifies as the dominant K-12 ransomware/data-breach pattern: local archive creation over files matching student/staff PII naming patterns, an outbound POST to a newly-seen or uncommon web destination shortly after archive staging, remote-service lateral-movement logons, and vssadmin/wbadmin shadow-copy or backup-catalog deletion consistent with inhibit-system-recovery staging ahead of ransomware deployment. Two or more signals co-occurring within a 10-minute window on the same host/segment indicate an active exfiltration-then-impact sequence. Referenced as sector-context for TL-2026-1824 (Sumner County Schools network intrusion); no confirmed data-exfiltration or encryption method has been disclosed for that specific incident as of the forensic-audit-pending public statement.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1005, T1071, T1567, T1021, T1489, T1490
- **Data sources:** sysmon (file_create EventID 11, process_creation EventID 1), proxy_web_logs, windows_security_eventlog (EventID 4624 LogonType 3)
- **Severity:** critical
- **Confidence:** medium

### Splunk SPL

```spl
`comment("TL-2026-1824: correlates archive staging, uncommon-destination web POST, lateral remote-service logon, and vssadmin/wbadmin inhibit-recovery within 10m - K-12 double-extortion exfil/impact staging")`
| multisearch
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 (TargetFilename="*.tar.gz" OR TargetFilename="*.zip")
      | eval signal="archive_staged" ]
    [ search index=proxy sourcetype="proxy:access" cs_method=POST (uri_path="*/upload*" OR uri_path="*/beacon*")
      | eval signal="web_post_uncommon_dest" ]
    [ search index=wineventlog sourcetype="WinEventLog:Security" EventCode=4624 Logon_Type=3
      | eval signal="lateral_remote_service_logon" ]
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*\\vssadmin.exe" OR Image="*\\wbadmin.exe") (CommandLine="*delete shadows*" OR CommandLine="*delete catalog*")
      | eval signal="inhibit_recovery" ]
| bin _time span=10m
| stats count values(signal) as signals dc(signal) as signal_diversity values(dest) as dest_hosts by _time, ComputerName
| where signal_diversity >= 2
| table _time ComputerName signals signal_diversity dest_hosts
| sort - _time
```

### Microsoft KQL

```kql
// TL-2026-1824: correlates archive staging, uncommon web POST, lateral logon, and inhibit-recovery commands within 10m
let window = 10m;
DeviceFileEvents
| where Timestamp > ago(24h)
| where FileName endswith ".tar.gz" or FileName endswith ".zip"
| project Timestamp, DeviceName, Signal = "archive_staged"
| union (
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where ActionType == "HttpConnectionOutbound" and (Url has "/upload" or Url has "/beacon")
    | project Timestamp, DeviceName, Signal = "web_post_uncommon_dest"
), (
    DeviceLogonEvents
    | where Timestamp > ago(24h) and LogonType == "Network"
    | project Timestamp, DeviceName, Signal = "lateral_remote_service_logon"
), (
    DeviceProcessEvents
    | where Timestamp > ago(24h)
    | where FileName in~ ("vssadmin.exe", "wbadmin.exe") and (ProcessCommandLine has "delete shadows" or ProcessCommandLine has "delete catalog")
    | project Timestamp, DeviceName, Signal = "inhibit_recovery"
)
| summarize Signals = make_set(Signal), SignalCount = dcount(Signal) by DeviceName, bin(Timestamp, window)
| where SignalCount >= 2
| sort by Timestamp desc
```

### Sigma

```yaml
title: Archive Staging Followed by Outbound POST to Uncommon Host (Exfiltration Over Web Service)
id: 3a9f6c4d-7e2b-4f1a-9c8d-000018240003
status: experimental
description: Detects local creation of a compressed archive (.tar.gz/.zip) followed within 10 minutes by an outbound HTTP POST to an uncommon or newly-seen destination path, matching the double-extortion data-staging-then-exfiltration sequence CISA documents as the dominant K-12 ransomware/data-breach pattern (AA20-345A, AA22-249A). Referenced as sector-context for TL-2026-1824 (Sumner County Schools network intrusion); no confirmed data-exfiltration method has been disclosed for that specific incident as of the forensic-audit-pending public statement.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-345a
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-249a
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-03
tags:
    - attack.collection
    - attack.t1005
    - attack.command-and-control
    - attack.t1071
    - attack.exfiltration
    - attack.t1567
    - attack.lateral-movement
    - attack.t1021
    - attack.impact
    - attack.t1489
    - attack.t1490
    - attack.tool.vice_society
logsource:
    category: proxy
detection:
    file_stage:
        TargetFilename|endswith:
            - '.tar.gz'
            - '.zip'
    web_post:
        cs_method: POST
        c_uri|contains:
            - '/upload'
            - '/beacon'
    timeframe: 10m
    condition: file_stage and web_post
falsepositives:
    - Legitimate backup software creating compressed archives and posting them to an approved backup/cloud-storage endpoint
    - SaaS/EdTech vendor integrations (e.g. a sanctioned SIS cloud-migration window) legitimately POSTing bulk data archives to a new vendor endpoint
level: critical
```

**Known false positives:**

- Legitimate backup software creating compressed archives and posting them to an approved backup/cloud-storage endpoint
- IT-scheduled vssadmin/wbadmin maintenance jobs (e.g. shrinking shadow-copy storage) outside a compromise context
- SaaS/EdTech vendor integrations (e.g. the disclosed Skyward cloud migration) legitimately POSTing bulk data archives to a new vendor endpoint during a sanctioned migration window

**Tuning notes:** Maintain an allowlist of approved backup/vendor destinations (including any active cloud-migration endpoints, e.g. a Skyward-style SIS transition) to suppress expected large POST/archive activity during sanctioned migration windows; require the vssadmin/wbadmin deletion signal to co-occur with an unapproved-destination POST or lateral-logon signal before escalating to critical severity; tune the archive-filename PII-pattern match list to the district's actual student/staff record naming conventions.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- K-12 External-Facing Brute-Force Burst Culminating in Valid-Account Logon (RaaS Initial Access) (locked: unlock with TL Creds)
- PrintNightmare-Pattern Spoolsv.exe Privesc with RaaS Persistence Account Creation & Process Masquerading (locked: unlock with TL Creds)
- Post-Compromise Data Staging, C2 Beacon & Web-Service Exfiltration with Inhibit-Recovery Staging (K-12 Double-Extortion Pattern) (locked: unlock with TL Creds)
- K-12 External-Facing Brute-Force Burst Culminating in Valid-Account Logon (RaaS Initial Access) (locked: unlock with TL Creds)
- PrintNightmare-Pattern Spoolsv.exe Privesc with RaaS Persistence Account Creation & Process Masquerading (locked: unlock with TL Creds)
- Post-Compromise Data Staging, C2 Beacon & Web-Service Exfiltration with Inhibit-Recovery Staging (K-12 Double-Extortion Pattern) (locked: unlock with TL Creds)
- K-12 External-Facing Brute-Force Burst Culminating in Valid-Account Logon (RaaS Initial Access) (locked: unlock with TL Creds)
- PrintNightmare-Pattern Spoolsv.exe Privesc with RaaS Persistence Account Creation & Process Masquerading (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Sumner County Schools provides limited update on data breach](https://mainstreetmediatn.com/articles/gallatinnews/sumner-county-schools-provides-limited-update-on-data-breach/)
- [TN Sumner County Schools provides limited update on data breach](https://databreaches.net/2026/08/02/tn-sumner-county-schools-provides-limited-update-on-data-breach/)
- [Data breach delays start of Sumner County school year](https://wpln.org/post/data-breach-delays-start-of-sumner-county-school-year/)
- [Sumner County Schools delays start of year after network data breach](https://www.wsmv.com/2026/07/22/sumner-county-schools-delays-start-year-after-network-data-breach/)
- [Sumner County Schools' network restored after data breach delays start of school year. Here's what you need to know](https://www.wsmv.com/2026/07/31/sumner-county-schools-network-restored-after-data-breach-delays-start-school-year-heres-what-you-need-know/)
- [Sumner County, TN Schools delays start of school year due to network breach](https://www.wkrn.com/news/local-news/sumner-county-schools-delays-start-of-school-year-due-to-network-breach/)
- [Cybersecurity expert weighs in on Sumner County Schools network breach](https://www.yahoo.com/news/us/articles/cybersecurity-expert-weighs-sumner-county-234318721.html)
- [Cybersecurity expert weighs in on Sumner County, TN Schools network breach](https://www.wkrn.com/news/local-news/cybersecurity-expert-talks-sumner-county-schools-network-breach/)
- [Sumner County Schools delays start of year after network breach, families still search for answers](https://www.newschannel5.com/news/state/tennessee/sumner-county/sumner-county-schools-delays-start-of-year-after-network-breach-families-still-search-for-answers)
- [Sumner County Schools delays opening after network breach in Tennessee](https://dysruptionhub.com/sumner-schools-network-breach-delay/)
- [Ransomware Reference Materials for K-12 School and School District IT Staff](https://www.cisa.gov/stopransomware/ransomware-reference-materials-k-12-school-and-school-district-it-staff)
- [Cybersecurity for K-12 Education | CISA](https://www.cisa.gov/K12Cybersecurity)
- [#StopRansomware: Vice Society (AA22-249A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-249a)
- [Cyber Actors Target K-12 Distance Learning Education to Cause Disruptions and Steal Data (AA20-345A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-345a)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1824