Spokane Public Schools Data Breach

SOCRadar threat intelligence has identified that Spokane Public Schools, a public school district in Washington State, was listed as a claimed victim by the ransomware group nightspire on October 12, 2026. The listing followed the observation of approximately 25 credentials associated with the district’s domain, spokaneschools[.]org, with 10 of these credentials identified as direct employee authentications against critical identity and administrative infrastructure. This exposure is particularly concerning due to the potential for broad lateral access, especially if credentials linked to Active Directory Federation Services (ADFS) are compromised. Educational institutions, while not always the primary target sector for all ransomware groups, can become attractive targets due to the sensitive student and employee data they manage, and the potential for disruption to critical services. In the 60 days preceding this listing, nightspire claimed approximately 42 victims. The group has primarily targeted the Transportation, Professional Services, and Healthcare industries, with the United States, Colombia, and the United Kingdom being their main operational geographies. The targeting of the Education sector by nightspire appears to fall outside their typical profile. However, the method of initial access, relying on credentials harvested by infostealers, means that sector affinity is less critical than the presence of exposed endpoints. Co-victims of nightspire in this period include KP Industries (GB, Manufacturing), MGT Lojistik (TR, Transportation), and Cognosis Limited (GB, Technology). The current incident does not strictly align with the group’s usual sector focus, but the underlying attack vector remains consistent with their modus operandi.

SOCRadar’s analysis identified approximately 25 credentials associated with spokaneschools[.]org. Of these, 10 were classified as direct employee authentication records. These records targeted four specific systems: the district’s Active Directory Federation Services (ADFS) identity provider, its primary login portal, the PowerSchool student information system, and an HR employment portal. Additionally, an email-based authentication path was identified within the sampled data. The exposure of ADFS credentials is of significant concern, as ADFS serves as the central identity bridge for the district, potentially granting broad lateral access across federated services. The detected credentials showed freshness concentrated in the days immediately preceding the nightspire listing and extending up to the date of SOCRadar’s query. This temporal pattern is indicative of infostealer harvesting occurring during or in close proximity to the ransomware deployment, rather than a legacy exposure from a prior, unrelated campaign. This suggests a potential connection between the observed credential exposure and nightspire’s likely method of initial access, which often involves infostealer-harvested credentials obtained from compromised endpoints and subsequently traded on dark web markets. Immediate priorities for Spokane Public Schools should include forced password rotation for all accounts within the exposed systems. Implementing phishing-resistant multi-factor authentication (MFA) on ADFS and the primary login portal is crucial. A comprehensive audit of authentication logs from the 30-day period preceding October 12 is also recommended to identify any unauthorized access or malicious activity. The reliance on stealer logs for initial access indicates a need for continuous monitoring of dark web and stealer-log feeds, alongside proactive credential hygiene checks, password rotation, and review of MFA configurations.