In the spring of 2022, the Tenafly Public Schools’ district network was shut down for nearly two weeks by hackers who held the data and access for ransom. This resulted in the suspension of regular operations until the problem could be addressed. Despite the issue being resolved, students, staff, and parents have never stopped questioning what really happened.
On June 2, the morning of the hack, students and staff attempted to log onto their computers to continue their work. However, as they attempted, each was met with the same ambiguous message: “Your password was changed 6 hours ago.” Confused, students and staff looked at one another and asked, “Were you able to log in?” This question echoed throughout the halls when students and staff realized that no one had been able to log in that day. The question that remained: What had happened?
The cyberattack on Tenafly Public Schools led to a wave of reactions among students, but many were less concerned with the severity of the situation and more focused on the immediate benefits. Without access to their digital platforms, students were suddenly free from the looming pressure of final exams.
“It was like a celebration,” Heeseo Yoon (’25) said, recalling the unexpected break.
Without access to online tools, teachers scrambled to convert everything to teaching “old school” with paper-based assessments. With the network being held hostage for the first two weeks of June, the district decided to cancel final exams. Despite the chaos, some students saw the attack as an opportunity to relax.
“No one took it seriously,” Yoon admitted.
The disruption quickly turned into an opportunity for speculation, with gossip spreading quickly throughout the halls.
“There were so many rumors about what actually happened,” Emily Roglieri (’25) remarked. Rather than focusing on the security breach, students were more interested in the mystery surrounding the event.
Community members have often wondered how much the district paid the hackers. According to a previous Echo article, published on June 17, 2022, after the network was restored, the district was only responsible for paying its insurance deductible, with the insurer presumably paying the rest. “At this time, we believe that we are only responsible for paying our $25,000 deductible,” Ms. Christine Corliss, District Webmaster and Communications Manager at the time of the event, told Echo reporters. Shauna DeMarco, the former superintendent of TPS, declined to comment for this article. Detective Matthew Savitsky, the Student Resource Officer at Tenafly High School, was unable to give any information regarding the investigation. “I am not allowed to disclose anything to the public,” he said. “If I were you, I would go ask Mr. Morrison.” Mr. Morrison also did not offer any further details on the cyberattack, saying, “You guys should reach out to the head of the Tech Department, Robert Caputo. He knows the most out of all of us.” Mr. Caputo, though, did not respond to emailed requests for an interview. The current Superintendent, Mr. Michael Ben-David, was unfamiliar with the topic because he was not superintendent then, so was unable to provide any information. Still, it appears that former and current administrators, as well as the police, are reluctant to share details of the cyberattack. As a result, questions remain: What truly happened and why is nobody speaking out?
In the aftermath of the security breach at Tenafly, the vulnerability of schools to cyberattacks has come into sharp focus. According to Mr. Mirabito, a history teacher at Tenafly High School, the breach occurred because the school lacked dual-factor authentication at the time. “What ended up happening was we didn’t have dual-factor authentication, so we had only one way to log in,” he explained. “Ironically, the school was moving towards two factors over the summer.” Dual-factor authentication provides an extra layer of security, requiring users to verify their identity with both a password and a secondary method, such as a key.
Despite the breach’s impact, Mirabito emphasized that the school should not bear full responsibility for the attack. He pointed out that hackers often target schools and hospitals precisely because their organizations are “soft targets.” “They know that a school doesn’t have the money or resources to protect itself from these types of breaches,” he said.
The timing of the breach in June added further complexity. “It happened in June, which was particularly impactful because that’s when academic records are sent to colleges for seniors,” Mirabito noted.
The cyberattack caused major disruptions. “We couldn’t get into our Google Drive, couldn’t get into our email, we couldn’t get into our Genesis accounts, couldn’t get into any of our lessons or activities, nothing,” Mrs. Celli, a history teacher at Tenafly High School, noted. Classes and finals were canceled and access to files was blocked. Teachers had to rely on alternative methods to continue their work. “I had to find different ways to teach,” Celli remembered. “We had to go very old-school with things and had to be creative and have patience.”
Despite the setbacks, Mirabito observed that the situation led to some positive outcomes. “In some ways, it made us better,” he said. The lack of technology forced students and teachers to embrace hands-on, collaborative learning experiences. While the breach was a challenge, it served as a valuable learning experience, and the school has since implemented strong security measures to prevent future incidents. “Now, we are more protected as a school from this ever happening again,” Mirabito concluded.
Luckily, the timing of the event was towards the end of the year, allowing the TPS Technology Department an opportunity to reinforce a more secure technology system when school wasn’t in session during the summer. The following year, students were able to resume normalcy. Google Classroom was up and running again, lesson plans were restored, and with the brand new two-factor authentication system (Duo), students and faculty could be confident that something like this would never happen again.
Although the district was able to develop a more secure technological system, there are still unanswered questions. When will we get the truth? Perhaps never, since insurance companies require policy holders to keep the details of payouts confidential.
