Classes at Des Moines Public Schools will resume on Thursday with an “offline learning experience” following a cybersecurity incident at the state’s largest school district. The district detected “unusual activity” on its network Monday morning, prompting DMPS to take the district’s internet and network services offline and cancel classes Tuesday and today.

Phil Roeder, the director of communications and public affairs for DMPS, said in an email that the incident is being treated as a ransomware attack but that it is not confirmed at this time.

In an update posted on the DMPS website Tuesday evening, the district said DMPS IT professionals made significant progress in restoring its systems. DMPS interim Superintendent Matt Smith said in a video update today that forensic evidence collected from the school district’s servers has been turned over to the district’s cyber insurance company for investigation.

How the incident began has not been determined, but it did come from an outside source, not within the district, Roeder said. He said the investigation will also determine whether any records or information about students or employees were compromised.

Smith spoke at a press conference Tuesday to explain why school could not resume while the network was offline.

“When the system is down it impacts every aspect of our organization — small to large impact,” Smith said. “It impacts our routing system to make sure that we are picking up students at the right spot at the right time, that we know who’s on our bus and who’s not. It impacts our food and nutrition system to make sure that we are supplying the meals necessary for all of our students, but specifically for our students who require a specific dietary meal … all of that information is housed on our network. From those points, all the way to our curriculum instruction opportunities for students with IEPs. All of this is operated through the network, so when our network is down and we are working to make sure that we can safely get it back up, all of these areas are potentially compromised.”

The district’s systems affect around 30,000 students and nearly 5,000 staff members.