Richmond Public Schools, the public school division of Virginia’s capital, took its network offline on Wednesday 21 October 2026 after staff discovered ransom notes on district-issued laptops that morning. All 53 campuses were impacted, and the division serves approximately 22,000 students. Cybernews describes it as one of the top 100 largest school divisions in the US, though the report names no ranking. Schools stayed open through the outage, with limited phone and email service and restricted access to online classroom tools, in what officials called a shift to a technology-free learning environment for the rest of the week.
The district has not confirmed that any student data was stolen. That distinction matters more than any other detail in this story: the attackers claim they stole sensitive information and threatened to publish it unless the district contacts them, but as of Wednesday evening the district had not confirmed the theft of any data, and it is unclear whether any student data was accessed at all. No ransomware group has been named in any source so far.
What happened on Wednesday
The sequence, as reported, is: discovery, then an internal warning, then a public outage notice, then confirmed “attack” language. The district first became aware of the attack on Wednesday morning, after employees reportedly discovered threatening messages on their district-issued laptops, according to Cybernews. At 7:00 a.m. ET, parents and school employees were emailed instructions not to log into devices or platforms or connect to the district network while the technology issue was being investigated. Note the wording: the morning message described a technology issue; the word “attack” came only in the afternoon email. Around 1:30 p.m. ET, schools announced a divisionwide network outage on school websites and notified families through the ParentSquare platform. By the afternoon, a second email, sent to all teachers and staff, warned of an attack and a subsequent system shutdown, according to VPM News as cited by Cybernews. The exact time of that afternoon email is not given in the cited coverage. Superintendent Jason Kamras also put out a statement on Wednesday afternoon, reported by Cybernews, that “the network was temporarily taken offline as a precaution” and to help the remediation process. He added: “School is proceeding as scheduled. The incident is not affecting the safety of students or staff.”
The outage reached deep into daily school operations. Affected systems reported include Wi-Fi, school security cameras, landlines, the PowerSchool education portal, and school-issued Chromebooks. Teachers were also blocked from accessing attendance records, making copies, writing passes, or using their smart boards. Sofia Barbieri, a teacher at Henderson Middle School, told The Richmonder that without database access, staff could not contact parents in a medical emergency and that cameras and landlines did not work. The Richmonder, Richmond’s nonprofit newsroom, independently confirmed the incident on Wednesday afternoon and published a photo of an employee screen reading “Critical Alert: Data Breach and Encryption Notice — Your Organization Is in Danger”. The district is working with law enforcement and outside cybersecurity specialists to determine the scope and restore systems securely.
What is confirmed, and what is not
Confirmed: a cyberattack on Wednesday 21 October, ransom notes found on staff laptops on Wednesday morning, the network taken offline as a precaution, schools open on limited systems, and law enforcement and outside specialists engaged. Claimed by the attackers, through the ransom notes: that they broke into the network, stole an unknown amount of sensitive information, and will publish it unless the district contacts them. Unconfirmed: whether any student data was actually accessed or stolen, and which group is responsible. Cybernews characterised the situation in its own takeaways as student data being at risk; that is Cybernews’ characterisation, not a district statement, and this article does not treat it as a confirmed exposure count.
Richmond is not the first school district hit this year
The Richmond schools ransomware attack is the third of the three incidents in this comparison, after Hanover in March and Jerome on 17 October. Our own comparison, compiled from the cited sources, is below; none of the figures are invented, all come from the sources cited in this article.
| District | When | Attacker’s move | Schools’ response | Data theft confirmed? |
|---|---|---|---|---|
| Richmond Public Schools, VA (about 22,000 students, 53 campuses) | 21 Oct 2026 | Ransom notes on staff laptops; leak threat | Network taken offline; schools STAYED OPEN, “technology-free learning” | NO, not confirmed as of 21 Oct evening |
| Jerome School District, ID | 17 Oct 2026 | Ransomware attack; surveillance cameras, electronic door locks, HVAC seized; undisclosed ransom demanded | Shut down for 2 days | Partially: attackers accessed student data, but the district believes most was not compromised; ransom demanded, amount undisclosed |
| Hanover County Public Schools, VA | March 2026 | Malicious actor accessed network data, attempted to deploy ransomware to encrypt portions of the network | Investigation; findings disclosed later | Not confirmed; actor accessed network data and attempted encryption |
TechReview analysis: Richmond is the only one of the three where the district kept all 53 campuses open through a division-wide outage. The “technology-free week” response versus Jerome’s full two-day shutdown is the contrast a parent reader actually cares about: one district absorbed the outage inside open schools, the other closed entirely. On Jerome, the district’s position evolved: its first statement said student devices and data remain secure, while its later statement, via KMVT and reported by Cybernews, said attackers accessed student data but the district believes most had not been compromised. Hanover County is a separate, earlier Virginia district incident, mentioned by The Richmonder as context only, and it is not the same incident as Richmond.
What should Richmond parents do?
Richmond parents should watch for phishing messages that use school details, check PowerSchool accounts for unusual activity, and wait for the district’s statement before assuming any data was stolen, because the district has not confirmed any data theft as of Wednesday evening.
- Delete emails or texts claiming to be from the school that ask for passwords, payments, or personal details.
- Check PowerSchool accounts for unusual activity and change the password immediately if anything looks unfamiliar or out of place.
- Call the school directly on a known number if a message about your child feels urgent or suspicious.
- Wait for the district’s own statement before assuming any student data was stolen, leaked, or published online.
- Keep the school’s official updates as the only source for reopening and system restoration news.
If personal information is later confirmed stolen, the steps in our data breach guide apply in full: what to freeze, what to monitor, and who to call first. Read our data breach guide: what to do if your personal information was leaked, and follow our 2026 data breach tracker for confirmed incidents as they develop.
What to watch next
Two things will change this story. First, whether the district confirms or rules out data theft, and what kind of data, if any, was accessed. Second, when systems are fully restored and what the investigation attributes the attack to. Until the district speaks on data, do not assume your child’s records were stolen because of this incident; no confirmed consumer data theft from a named source is established. This article will be updated on the same page if the district confirms data theft or names an attacker group.
Sources: Cybernews, “Ransom notes appear on Richmond schools’ laptops after cyberattack”, 22 Oct 2026 (Richmond timeline and Kamras statement); Cybernews, “Hackers take control of school cameras, door locks in Idaho”, 21 Oct 2026 (Jerome: ransomware, seized systems, ransom demand, later data position via KMVT); Idaho Ed News, “Jerome cancels school after weekend cyberattack”, 19 Oct 2026 (Jerome’s first statement); The Richmonder, “Cybersecurity incident disrupts Richmond Public Schools’ internet, phone services”, 21 Oct 2026 (Richmond, plus its Hanover County reference citing the Hanover County Public Schools investigation); VPM News coverage cited inside the Cybernews Richmond report.
