WORCESTER • MASSACHUSETTS • SCHOOLS
Worcester, on the record.
Worcester Today reports on Worcester Public Schools from the source documents — public records requests, school committee minutes, budgets, and filings. Every document below is a primary record, hosted here for anyone to read.
PUBLIC RECORDS TRACKER
Requests to the City of Worcester
Every public records request submitted under G.L. c. 66, § 10 — with the current status and links to the responsive records, exactly as produced.
| Request | Scope | Status | Responsive records |
|---|---|---|---|
|
W091663-070926
Submitted July 9, 2026 — School choice / voluntary transfer data, de-identified aggregate by school year, Nelson Place specifics, and all policies/procedures/forms used to process transfer requests.
|
De-identified aggregate transfer-request data (approved/denied by school and grade); Nelson Place subset; processing policies and procedures; data dictionary. | IN PRODUCTION Sample produced Aug 3; rolling production underway. City fee petition SPR26/2850: 30-business-day extension granted, redaction-fee request denied. |
|
|
W092366-072426
Submitted July 24, 2026 — Audit-trail request: how W091663-070926 was routed, handled, and the basis for the City's July 23 fee estimate and statements.
|
Records showing how the City routed and processed W091663-070926, including the July 23 fee estimate and "no responsive records" determinations for items 4–6. | ACKNOWLEDGED Acknowledged Jul 24; status update received Aug 7. Awaiting substantive production. |
|
|
W092610-072926
Submitted July 29, 2026 — Full audit trail for the IEP, the Xerox AltaLink B8270 MFP, and DocuSign envelope C00C81CC-1065-8C72-83F2-9C52D8BD280B.
|
Audit trail: Xerox AltaLink B8270 MFP print/scan/copy logs and DocuSign envelope activity for the cited envelope ID. | ACKNOWLEDGED Acknowledged Jul 29. Awaiting substantive production. |
|
|
Jul 30, 2026 · PRR / Preservation
Submitted July 30, 2026 — Urgent public-records request and preservation notice re the phishing email impersonating Dr. Tammy Murray: message trace, aggregate recipient counts, incident response, and public notification.
|
Message trace for the authenticated phishing email, aggregate recipient counts, incident-response records, and records of family/systemwide notification. | PENDING RESPONSE Submitted with preservation notice. See the Security section below for the supporting analysis. |
|
|
Jul 30, 2026 · Netlify PRR
Submitted July 30, 2026 — Any Worcester Public Schools use of or contact with Netlify (the phishing landing page was hosted on murraytammy.netlify.app).
|
Records of any WPS use of, contact with, or accounts on Netlify; related to the phishing landing-page analysis. | PENDING RESPONSE Submitted with the phishing incident package. |
|
W091663-070926 timeline
- JUL 9, 2026
Request submitted — de-identified aggregate school-choice/transfer data, Nelson Place subset, policies and procedures. - JUL 23, 2026
City response + fee estimate — City stated no responsive records for items 4–6 and estimated $27,162 (1,086.5 hours × $25/hr) to produce the full request: ~400,000 cells of Excel data plus 1,350 pages of responsive records requiring cell-by-cell FERPA redaction review. - JUL 24, 2026
City petition SPR26/2850 — City sought a time extension and permission to charge for segregation/redaction. Audit-trail request W092366 submitted the same day. - JUL 31, 2026
SPR26/2850 determination — 30-business-day extension granted; permission to charge for redaction denied (untimely petition). City issued the supplemental response with a revised fee estimate of $1,916.75 — a 93% reduction after the request was narrowed to the last three school years and district-wide aggregates. - AUG 3, 2026
Sample production — District-wide and Nelson Place sample datasets delivered; rolling production agreed. - AUG 4, 2026
SPR26/2861 determination — appeal of the July 23 fee response closed administratively after the Aug 3 further response; substantive response appealable within 90 days. - AUG 10, 2026
Follow-up — request for the basis of the "no responsive records" determination for item 4 (policies/procedures). - AUG 13, 2026
Dashboard published — the sample data was normalized, verified, and published as the School Choice Decision Dashboard below.
The fee story: $27,162 → $1,916.75
The City's July 23 estimate priced the full request at $27,162 — 1,086.5 hours of cell-by-cell review, mostly to redact the transfer-reason field for FERPA. After the appeal (SPR26/2861) and a request narrowing to the last three school years at district-wide aggregate level, the City's July 31 supplemental response cut the estimate to $1,916.75 — a 93% reduction. The Supervisor of Records also denied the City's request to charge for segregation/redaction (SPR26/2850, untimely petition). The fee petition and both determinations are linked above.
SCHOOL CHOICE DATA
School Choice Decision Dashboard
1,240 transfer decisions from the W091663-070926 sample — approved vs. denied by school, grade, and level, with a school-vs-school comparison tool. Math-verified twice: 798 + 442 = 1,240.
Interactive dashboard
Filter by school level, sort by volume or approval rate, compare any two schools, and export the summary CSV. Built from the responsive records exactly as produced.
The numbers, quickly
1,240 decisions total — 798 approved (64.4%), 442 denied. Elementary requests approve at 69.2%; middle school at 35.9%; high school at 59.3%. City View Discovery, Roosevelt, and West Tatnuck led in volume.
Source: W091663-070926 sampleRead the sample honestly
This is a sample, not the complete universe of decisions. Rates are descriptive; small schools can look extreme because of low counts. Full school-year data is still rolling in production.
Source: SPR26/2850 + 2861 determinationsSECURITY
Worcester Public Schools phishing incident
On July 30, 2026, Parent Data Force notified Worcester Public Schools of an authenticated phishing email sent through the district's domain, impersonating Dr. Tammy Murray and directing recipients to a Netlify-hosted landing page (murraytammy.netlify.app). The analysis reports below were submitted to the district and are published here for public accountability.
Forensic Email Analysis Report
What it found: the message authenticated as Worcester mail — Gmail recorded it passing SPF/DKIM/DMARC checks — meaning ordinary anti-spoofing controls did not reject it. The message blind-copied a parent address whose source is unknown, and the sending mechanism (active account session, OAuth access, or compromised relay) must be identified by the district. The EML does not establish whole-domain compromise, but it does establish at least one district identity was used to send mail that Gmail treated as legitimate.
Why it matters: if the sending mechanism involved an active account session or broad OAuth access, the risk may extend beyond sending mail to reading messages, reviewing files, and accessing confidential special-education records.
Privacy note: the public copy of this report is redacted to remove a recipient's personal name and email address. The unredacted version was provided to the district and the Supervisor of Records as appropriate.
Phishing Landing Page & Public-Risk Analysis
What it found: the email lured families with a "secure message" pretext to a Netlify-hosted page. The hostname currently does not resolve — consistent with removal, suspension, or expiration — so the exact landing-page fields and data-storage destination cannot be reconstructed from public sources. The deception analysis found the claimed identity, subject, secure-message language, signature, and destination domain all consistent with a credential-harvesting campaign.
Why it matters: families regularly receive confidential special-education records, evaluation materials, and meeting notices from the district — making a spoofed district message a particularly dangerous lure.
What was sent to the district
- JUL 30, 2026
Forensic analysis — authenticated phishing email analysis delivered. - JUL 30, 2026
Good-faith security notifications — multiple notifications including requests for family and systemwide notice, preservation, and independent review. - JUL 30, 2026
Urgent PRR / preservation notice — message trace, aggregate recipient counts, incident response, and public notification records requested. - JUL 30, 2026
Netlify records request — any WPS use of or contact with Netlify.
SUPPORT
Keep Worcester reporting funded.
Records requests cost money — filing fees, redaction time, and appeal work. Your support pays for the documents behind the stories.
OUR STANDARD
We do not sell family data.
Worcester Today reports from public records and source documents only. We never publish student records or confidential casework — the datasets hosted here are de-identified aggregates exactly as produced by the City.