# Oneonta Schools Shut by Ransomware as Group Claims Student Records

- URL: https://usa-24.com/oneonta-city-school-district-ransomware/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-31T16:49:31.657Z
- Updated: 2026-10-31T16:49:31.665Z
- Topics: Ransomware, K-12 Cybersecurity, School Districts, Data Breach, New York

> Oneonta City School District closed schools after a ransomware attack, and an anonymous email claims student records were taken. The district has not confirmed any data theft.

## Key takeaways

- Oneonta City School District closed schools to students and staff on Friday, Oct. 23, after a ransomware attack discovered on Oct. 21.
- The superintendent's letter to parents said the problem was first believed to be internal technology issues before it was identified as ransomware.
- An anonymous email on Tuesday, Oct. 27, claimed the group Shiba stole Oneonta student records, a claim that remains unverified.
- The district has not confirmed any data theft and has said it has not yet determined whether student records or personal information were compromised.
- Richmond Public Schools in Virginia confirmed a ransomware attack on Oct. 21, and Jerome, Idaho's district was hit on Oct. 17, but no source links those incidents to Oneonta.

## Oneonta City School District ransomware timeline

Oneonta City School District closed its schools this month after a ransomware attack, and an anonymous email now claims the attackers took student records. The district, which National Center for Education Statistics data put at five schools and about 1,700 students in 2024-25, has not confirmed any data theft. The claim is unverified, and the story is still moving.

The attack was discovered on Oct. 21, according to the [Oneonta Daily Star](https://www.thedailystar.com/news/local_news/cyberattacker-claims-it-stole-oneonta-student-records/article_051edf1d-b2df-4c4e-a87f-f8a2b43b302c.html). Within a week, the district had closed schools twice and an anonymous email had claimed credit for the breach. Here are the key dates as reported:

- **Oct. 21:** The attack is discovered.
- **Friday, Oct. 23:** Schools close to students and staff.
- **Monday, Oct. 26:** A conference day, with the closure extended to students.
- **Tuesday, Oct. 27:** An anonymous email claims the attack for a group called Shiba.
- **Thursday, April 30:** Becomes a regular school day as a makeup day. The reports do not name the year, so families should confirm the date on the district calendar.

[Hoodline](https://hoodline.com/2026/10/oneonta-schools-shut-down-twice-after-ransomware-attack-hits-district/) reported that the district shut schools twice, and WBNG reported the initial closure.

## How the district described the attack

The district first believed it was dealing with internal technology problems. Superintendent Thomas Brindley later wrote to parents, in a letter cited by allotsego.com: “What we initially believed to be internal technology issues has since been identified as a ransomware attack.” That shift, from troubleshooting to a security incident, is the core of the timeline.

A district media coordinator, Angela Brindley, confirmed the attack by email to [WSKG](https://www.wskg.org/regional-news/2026-10-23/oneonta-city-schools-close-following-ransomware-attack). She wrote: “We do not yet have enough information to determine whether any student records” The district's position on the question parents care about most is that it does not yet know.

The district said it was assessing the full scope of the incident and had not yet determined whether student records or personal information were compromised. It is working with a third-party cybersecurity firm to assess the attack, according to WBNG. Neither the full scope of disruption nor the date schools fully reopened appears in the reporting so far.

The stakes are real. School districts hold years of personal data, from enrollment and contact details to health and special-education files. That makes a student-information system an attractive target, and the list of people potentially affected can be far larger than the students in the building on any given day.

## The Shiba claim and why it is unverified

On Tuesday, Oct. 27, an anonymous email sent to several media outlets claimed credit for the attack. It named the group “Shiba ransomware” and said the group stole Oneonta student records.

USA 24 could not independently verify that claim, and the district has not confirmed any data theft. An emailed claim is not evidence. Extortion crews have a reason to overstate what they took, because a bigger haul adds pressure on the victim. Ransom-group claims are not always accurate, so this one should be treated as unverified until the district or a forensic firm confirms what the data contains.

A forensic review is the most reliable way to test the claim, because it can show what was accessed on the district's systems. Until that happens, the Shiba email is the only claim in the reporting. [Kaseya's weekly breach roundup](https://www.kaseya.com/blog/the-week-in-breach-news-10-28-26/) reported that no ransomware group had claimed the Oneonta attack at the time it was written, which leaves the identity of the attackers open.

## Richmond and Jerome show a wider pattern

Oneonta is not the only school system hit this month. Kaseya reported that Richmond Public Schools in Virginia confirmed a ransomware attack on Oct. 21. Teachers there found ransom notes on laptops, and Wi-Fi, PowerSchool and other systems were unavailable. Oneonta was hit separately, and no source in the reporting links the two.

In Idaho, the Jerome School District was hit by ransomware on Oct. 17. Superintendent Brent Johnson described the attack to [Idaho EdNews](https://www.idahoednews.org/news/this-is-a-terrorist-crime-jerome-superintendent-shares-details-on-ransomware-attack/): “This is a terrorist crime that happened to us.”

The broader trend is also measurable. According to [WSKG](https://www.wskg.org/regional-news/2026-10-23/oneonta-city-schools-close-following-ransomware-attack), a 2023 New York State Comptroller report found that cyberattack and ransomware incidents in the state rose 53% from 2016 to 2022. One regional report, cited by allotsego.com, says school ransomware attacks have surged. It points to aging infrastructure, limited IT staffing and valuable student and staff data as reasons K-12 districts are often targeted.

Ransomware is not limited to schools. USA 24 has covered [C3RB3R ransomware hitting Synology NAS devices running outdated DSM software](https://usa-24.com/synology-nas-ransomware-c3rb3r-dsm-update/), which shows extortion crews working through many kinds of organizations at once.

## What parents and staff should do now

The district has not said what was taken, but several steps make sense now.

- **Watch for official notices.** The next district update will be the first clear signal of whether any records left the district's systems.
- **Check what your child's record holds.** Confirm whether it includes Social Security numbers or medical information, and ask the school what it keeps.
- **Freeze credit if a Social Security number breach is confirmed.** A credit freeze is free and blocks new credit applications in your name. You place one with each of the three bureaus: Equifax, Experian and TransUnion.
- **Treat unexpected district emails with suspicion.** Attackers often follow up with extortion or fake “notice” messages, so confirm any message by calling the number on the district's official website.
- **Ask IT about basic defenses.** Staff can ask whether multi-factor authentication covers staff email and administrative systems, and whether offline backups are tested. The reporting does not confirm either step was taken in Oneonta.

Early breach totals can change. USA 24 has reported that an [iRhythm breach is now listed at 8.2 million people on the HHS portal](https://usa-24.com/irhythm-data-breach-zio-patients-2/), a reminder that the first number in a breach story can move. Parents whose children attend other districts can ask the same questions: whether families have been notified, and whether a third-party vendor hosts the student-information system.

## Open questions and what to watch next

Several questions remain open. The most important is whether the Shiba group holds Oneonta student data, and what that data includes. The district has not said when schools fully reopened, and the full scope of disruption is still unclear. An allotsego.com report also mentioned a city audit of its own IT systems, but the reporting does not establish whether that audit changed the district's response.

Watch three signals. First, a written update from the district that describes what was accessed, if anything. Second, findings from the third-party firm the district is working with. Third, whether the Shiba group publishes material that reporters can check. Until one of those arrives, the accurate account is that a New York district lost days of instruction, and its families do not yet know whether their children's records were taken.

## Frequently asked questions

### Was student data confirmed stolen in the Oneonta City School District ransomware attack?

No. The district confirmed a ransomware attack and said it had not yet determined whether student records or personal information were compromised. An anonymous email claims the Shiba group stole student records, but that claim has not been verified and the district has not confirmed any data theft.

### When did Oneonta schools close because of the ransomware attack?

Schools closed to students and staff on Friday, Oct. 23. Monday, Oct. 26 became a conference day, and the closure was extended to students. The attack was discovered on Oct. 21, according to the Oneonta Daily Star, and the reporting does not give a full reopening date.

### Who is the Shiba ransomware group?

Shiba is the name an anonymous email gave when it claimed credit for the Oneonta attack on Oct. 27. The reporting reviewed here contains nothing that independently confirms the group or its activity, so the claim should be treated as unverified.

### What should parents do if their school district has a ransomware attack?

Watch for official notices and check whether your child's record includes Social Security numbers or medical data. If the district confirms a Social Security number breach, place credit freezes with Equifax, Experian and TransUnion. Confirm any unexpected district email by calling the number on the district's official website.

## Sources

1. [Oneonta city schools close following ransomware attack (WSKG)](https://www.wskg.org/regional-news/2026-10-23/oneonta-city-schools-close-following-ransomware-attack)
2. [Oneonta City School District closes following cybersecurity attack (WBNG)](https://www.wbng.com/2026/10/23/oneonta-city-school-district-closes-following-cybersecurity-attack/)
3. [Oneonta Schools Shut Down Twice After Ransomware Attack Hits District (Hoodline)](https://hoodline.com/2026/10/oneonta-schools-shut-down-twice-after-ransomware-attack-hits-district/)
4. [Cyberattacker claims it stole Oneonta student records (Oneonta Daily Star)](https://www.thedailystar.com/news/local_news/cyberattacker-claims-it-stole-oneonta-student-records/article_051edf1d-b2df-4c4e-a87f-f8a2b43b302c.html)
5. [Oneonta School District Confirms Ransomware Attack; Cyber Incident Now Under Investigation (allotsego.com)](https://www.allotsego.com/oneonta-school-district-confirms-ransomware-attack-cyber-incident-now-under-investigation/)
6. [The Week In Breach News: October 28, 2026 (Kaseya)](https://www.kaseya.com/blog/the-week-in-breach-news-10-28-26/)
7. ['This is a terrorist crime': Jerome superintendent shares details on ransomware attack (Idaho EdNews)](https://www.idahoednews.org/news/this-is-a-terrorist-crime-jerome-superintendent-shares-details-on-ransomware-attack/)
8. [Ransomware attack forces Oneonta City School District in New York to cancel classes (DysruptionHub)](https://dysruptionhub.com/oneonta-new-york-schools-ransomware-attack/)
9. [Oneonta City School District closed due to ransomware attack (Yahoo News/WUTR)](https://www.yahoo.com/news/articles/oneonta-city-school-district-closed-142204730.html)