SOUTH LYON — All South Lyon Community Schools buildings will be closed again on Wednesday, Sept. 17, the third day in a row, due to a “network security incident” that Superintendent Steve Archibald said prompted the district to engage cyber security experts.
In an email to families shortly after 8:30 p.m. and not long after the ending of the regularly scheduled school board meeting, Superintendent Steve Archibald wrote, “Unfortunately, SLCS will be closed tomorrow, September 17th, due to the network interruptions and phone systems being down. Our teams are continuing to work diligently to restore impacted systems. While there has been significant improvement, we cannot ensure our systems will be restored to the level of security and communication we need to safely open school.”
District schools were also closed Sept. 15 and Sept. 16 because of the incident.
Archibald reiterated during the school board meeting a message that he had written in an earlier email that the district had no evidence that any student data or faculty data had been compromised as a result of the incident. He further explained in the meeting that student and employee data is stored through a third party provider on a cloud-based network, separate from the schools’ network.
He also explained in the school board meeting that the primary reason school had been cancelled was due to the security incident “severely compromising” the ALICE (Alert, Lockdown, Inform, Counter, Evacuate) protocol, a federally endorsed program schools use to respond to critical incidents, including active shooters.
In an earlier email to Hometown Life, Archibald said certain systems had been taken offline “out of an abundance of caution” and the district had begun a thorough investigation with leading information technology experts. During the school board meeting, Archibald cited assistance from McDonald Hopkins LLC and Arctic Wolf Forensics and said the IT department had been working “nearly around the clock” since Sunday.
As of nearly 5 p.m. Sept. 16, phones in the district appeared to be out of order, with calls to the administrative office failing to go through or with a message that they were “temporarily unavailable.”
In an email to families shortly before 11 p.m. Sunday, Sept. 14, Archibald announced that school had been cancelled for the following day after the district “experienced a network outage that impacted some of our systems. This outage required us to shut down parts of our network as we work to remediate the issue. As a result, some of our network is not fully available.”
In a 4:30 p.m. Monday, Sept. 15, email, he confirmed that the continuing network outage was the result of a “security incident.”
“As previously communicated, on Sunday, September 14, 2025, we experienced a network outage that impacted some of our systems. We’ve since confirmed that this outage was the result of a network security incident.
“As a result of the incident, portions of our network remain shut down. We are working closely with external cybersecurity professionals to assist in our investigation and to restore our data. While we are working to do this as quickly as possible, it may be a few days before full functionality can be restored.”Check back for updates.
Contact reporter Susan Bromley at sbromley@hometownlife.com or 517-281-2412.
link