Ransomware
Ransomware takes two school districts offline
Richmond, Virginia and Oneonta, New York schools were hit by ransomware in the same week. What is confirmed, and what a school IT team should do first.
On the morning of Wednesday, October 21, staff at Richmond Public Schools in Virginia opened their district laptops to a ransom note. It claimed the attackers had taken personal, financial and operational data and encrypted critical files. The district switched off internet access across the division, which also cut email, online classroom tools and front office phones, which were back by the morning of October 22. Schools stayed open and teaching moved to paper.
The next day, the Oneonta City School District in New York found that what it first took for internal technology problems was a ransomware attack. It closed to students on Friday, October 23 and Monday, October 26, and planned to bring them back on Tuesday, October 27. Neither district has said how the attackers got in, and neither has confirmed whether student or staff data was taken. If you run IT for a school district, the useful part is what both had to do in the first days, and what would have made those days shorter.
What happened in Richmond
The note appeared on district laptops early on October 21. According to Government Technology, it demanded contact within 72 hours, told the district not to attempt its own recovery and warned against bringing in outside negotiators, threatening "permanent data loss". VPM reported that the message threatened to publish stolen data on a leak site. The district emailed students and staff early that morning, telling them not to connect personal devices to school networks (WTVR puts the email at 8 a.m., VPM at around 7 a.m.), and that afternoon Superintendent Jason Kamras said internet access had been taken offline as a precaution.
Sources told VPM the disruption reached Wi-Fi, phones, cameras and the PowerSchool portal, and that teachers could not take attendance, make copies or use smart boards, while students could not use their school Chromebooks. Accounts of the cameras conflict: Kamras later said all school security cameras were fully operational and local recording had continued. The district limited non-staff entry to caregivers and released children only to adults already approved in PowerSchool.
On October 22 Kamras said the district would offer free identity and credit monitoring to students and staff. Axios reported on October 26 that the district was still without internet. By October 29 the district had built a separate network that teachers and students reached through Chromebooks, and the FBI and Virginia State Police were working with it alongside a private contractor. The Richmond Times-Dispatch, as cited by Fox Richmond, reported that Kamras told staff there was "no evidence" their personal information had been misused or published on the dark web. No ransomware group has been named.
What happened in Oneonta
Oneonta's superintendent, Thomas Brindley, wrote that the district's technology team moved immediately to limit further unauthorized access. A third-party cybersecurity firm is investigating, and Brindley said local, state and federal authorities are involved. He told The Daily Star that staff had been trained for this kind of incident and were following a checklist, and the Monday closure became a staff conference day to plan the return.
A breach-tracking site, Breachsense, lists the district as claimed by a group called SHIBA, with no leak size. The Daily Star has run a headline saying an attacker claims to have stolen student records. The district has not confirmed either claim, and we could not verify it.
The first 72 hours
Both districts made the same first move: cut the network off from the internet, and tell people to stop connecting devices. That is the right call when you do not yet know what the attacker holds. Block the traffic at the firewall and leave the servers running: powered-off machines lose the memory and live connections an investigator needs, and you will want those logs to answer the data theft question later.
Then, in roughly this order:
- Call for help on day one. Your cyber insurer comes first if you have a policy, because it may name the response firms you have to use. Then the FBI field office or CISA at cisa.gov/report. Richmond worked with the FBI and state police; Oneonta with a contracted firm and authorities at three levels.
- Start the legal clocks. Virginia Code section 2.2-5514 requires every public body, including school boards, to report qualifying incidents to the Virginia Fusion Intelligence Center within 24 hours of discovery. In New York, the Part 121 regulations under Education Law 2-d require a report to the State Education Department's Chief Privacy Officer within 10 calendar days of learning of a breach of student data, and notice to affected parents and students within 60 calendar days. Check your own state before you need it.
- Take admin credentials away from the attacker. Reset domain admin, service and backup accounts from a clean machine, revoke sessions in Google Workspace or Microsoft 365, and disable any account you cannot explain. Do this before you start restoring, or the restored systems inherit the same access.
- Keep the building safe before the classroom. Richmond's fallback for dismissal was a list of approved adults pulled from PowerSchool. Have that list, emergency contacts and medical information on paper or on a device outside the network, refreshed every term.
- Give teachers something to teach with. Both districts lost the tools teachers depend on. Richmond printed classwork through outside printers and then handed out Chromebooks on a separate network.
- Publish only what you have confirmed. Neither district guessed at the cause in public. Pick one channel for updates and keep the help line staffed.
Before the next one
The ransom note in Richmond told the district not to try its own recovery. That pressure has teeth when the attacker can also reach the backups. Keep at least one copy of your student information system, finance and HR data offline or in immutable storage, on credentials that are not in the main directory, and run a timed restore at least once a year.
Separate the networks. Student Chromebooks, staff laptops, cameras and door controls, and servers belong on different network segments, with firewall rules between them. Chromebooks hold little data locally and are managed from the cloud, which makes them a practical fallback; Richmond used them to run its alternate network. Decide in advance which devices you would hand out on a clean network, and how.
Turn on multi-factor authentication for every staff account, and phishing-resistant keys for anyone with admin rights. In the Google Admin console that is Security, then Authentication, then 2-step verification, with enforcement on. In Microsoft Entra ID use a Conditional Access policy that requires MFA for all users. Keep admin accounts separate from the ones staff use for email.
Last, write the paper plan together with teachers and front office staff. Richmond's teachers' union asked for paper backups on day one. Oneonta's staff already had a checklist, and used the Monday closure to plan the return.
Our on-demand risk reduction work finds the shared admin accounts and flat networks that turn one infected laptop into a district-wide outage, and safeguarding and hardening puts MFA, segmentation and offline backups in place. If you want a second opinion on your plan, open the chat and Yaali, our AI agent, will pass your question to an engineer.
Sources: Government Technology, VPM, The Richmonder, WTVR, October 21, WTVR, October 22, WTVR, October 31, WRIC, Fox Richmond, Axios Richmond, Cybernews, WSKG, AllOtsego, The Daily Star, CNHI, Breachsense, Code of Virginia section 2.2-5514, 8 NYCRR 121.10, NYSED determination.