# Richmond Public Schools Cuts Internet Across 53 Campuses After Intrusion

- URL: https://usa-24.com/richmond-public-schools-cyberattack/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-23T18:25:51.579Z
- Updated: 2026-10-23T18:25:51.583Z
- Topics: School Cybersecurity, Ransomware, K-12 Education, Data Breach, Virginia Schools

> Richmond Public Schools in Virginia cut internet access across 53 campuses after an intrusion left ransom messages on staff laptops. The attackers set a 72-hour deadline, and the district has not confirmed data theft.

## Key takeaways

- Richmond Public Schools shut off internet access across its 53 campuses after staff found ransom messages on district-issued laptops on Wednesday, October 21, 2026.
- The attackers asked for contact within 72 hours and threatened to leak data, but the district has not confirmed data theft, a named group or ransomware.
- Schools stayed open, yet teachers lost access to attendance records, copies and interactive boards, and students could not use Chromebooks or digital assignments.
- The district told students and staff not to connect personal devices to school networks, and it has not announced a date for restored service.

Richmond Public Schools in Virginia shut off internet access across its 53 campuses after an intrusion left threatening messages on district-issued laptops. Staff saw the messages on Wednesday morning, October 21, 2026, and the disruption became public that afternoon. The district has not confirmed data theft, a named hacking group or ransomware, so the facts below may change before the weekend is over.

The ransom text is the most specific detail so far. As [Cybernews](https://cybernews.com/news/richmond-schools-ransomware-attack-ransom-note/) reported, the message read in part: "We have gained access to your network, extracted sensitive data, and encrypted your critical files." It also demanded contact within 72 hours and warned that unauthorized recovery attempts would cause permanent data loss, according to a syndicated report on [GovTech](https://www.govtech.com/education/k-12/ransomware-attack-forces-richmond-va-schools-offline).

## What the Richmond Public Schools cyberattack has confirmed

Superintendent Jason Kamras confirmed a cybersecurity incident that disrupted several operational systems, according to [WTVR](https://www.wtvr.com/news/local-news/richmond/richmond-public-schools-hit-by-cybersecurity-incident-students-told-to-stay-off-school-networks). The district sent a warning to students and staff at 8 a.m. telling them not to connect personal devices to school networks. In a statement quoted by Cybernews, Kamras said the network "was temporarily taken offline as a precaution."

Schools stayed open. The district said learning would continue in a technology-free environment, as [WRIC](https://www.wric.com/news/local-news/richmond/cybersecurity-incident-richmond-public-schools/) reported. The district also says the safety of students and staff is not affected, according to [WWBT](https://www.12onyourside.com/2026/10/21/cybersecurity-incident-richmond-public-schools-causes-internet-shutdown/) and [Dysruption Hub](https://dysruptionhub.com/richmond-schools-cyber-incident/).

## Timeline of the Richmond outage so far

- Wednesday morning, October 21, 2026: Employees see threatening messages on district-issued laptops.
- 8 a.m.: The district warns students and staff not to connect personal devices to school networks.
- Wednesday afternoon: WWBT publishes its report at 1:59 p.m. EDT, describing an internet shutdown.
- Following the shutdown: Phone and email service, online classroom tools and learning platforms are limited.
- Through the weekend: The attackers' 72-hour window for contact runs.
- Friday, October 23: No restoration date has been announced, and the district has not confirmed data theft.

The timeline shows a short gap between discovery and public disclosure, but a much longer gap between the outage and any answer about its scope. Parents and staff are still waiting on that answer.

## Richmond Public Schools internet down: what stopped working

The outage reached well beyond email. Teachers could not access attendance records, make copies or use interactive classroom boards. Students could not use Chromebooks or reach digital assignments, according to Dysruption Hub. WTVR and WWBT both report that phone and email service was limited as well.

[Hoodline](https://hoodline.com/2026/10/cyberattack-knocks-out-phones-email-at-53-richmond-public-schools/) went further. Its report said the outage also hit PowerSchool, the district's student information system, but the district has not confirmed that in its own statements, so treat the claim as unverified. If it holds, it would explain the attendance and grading problems teachers described, because those records typically sit in the student information system. That is an inference, not a finding.

The district has said some services may remain unavailable, according to WRIC, but it has not given a date. For families, that gap matters as much as any single outage detail, because it determines how long the school routine stays disrupted.

## Which claims about the attack remain unconfirmed

Ransomware is the most disputed label. Cybernews says the district confirmed a ransomware attack across all 53 campuses. Hoodline, WWBT and Dysruption Hub report that the district has not confirmed ransomware, data theft or the attacker's identity. Until the district clarifies, readers should treat ransomware as a claim rather than a settled fact.

Data theft is the second open question. The attackers say they took personal, financial and operational data, but the district has not confirmed the theft. No group has publicly claimed the attack in the coverage reviewed.

GovTech and Dysruption Hub report that the district is working with cybersecurity experts and law enforcement, and that the FBI is reported to be investigating. Those reports do not say how far that work has progressed.

A ransom note can claim to have taken data without proving it, and a deadline works as leverage whether or not the threat is real. Those are two separate questions, and the district has not publicly answered either one.

## Who is affected and what parents and staff should do

About 22,000 students are enrolled in the division. Their families and the staff at 53 campuses face disruption to classes, attendance, grading and communication. Cybernews places Richmond Public Schools among the top 100 US school systems by size, which makes this one of the larger districts to lose its network this year.

If you are a parent, a student or a staff member, these steps reduce risk while the investigation continues:

- Follow official district updates only. Treat texts, emails or social posts that claim to come from the district with caution until they are confirmed through official channels.
- Keep personal devices off school networks until the district says they are cleared.
- Watch for phishing or follow-up extortion messages that claim to come from the district. Do not click links or send account, payment or banking details in response.
- Staff who received a ransom message should keep screenshots and copies and pass them to the district's IT team or investigators. Incident responders generally advise keeping original messages rather than deleting them.
- Do not try to recover files or contact the attackers on your own. The ransom note warned that unauthorized recovery attempts would cause permanent data loss.

For a general checklist after a breach that exposes account data, see our guide on [what to do after the Capcom breach](https://usa-24.com/capcom-data-breach-what-to-do/).

## Why school districts keep getting hit

Schools hold large volumes of sensitive records on minors, staff and families, and many run lean security budgets. Expert commentary on other school attacks, cited in WRIC's coverage, has pointed to that funding gap. Nothing in the Richmond reporting ties this intrusion to a specific budget decision.

Richmond Community Schools in Indiana offers a useful comparison. In September 2024 it disclosed that student and staff information in PowerSchool had been breached in a ransomware attack, according to [DataBreaches.Net](https://databreaches.net/2024/09/29/richmond-community-schools-reports-ransomware-attack-scranton-school-district-paid-ransom-in-march/). That was a separate incident with no link to the Virginia attack. The pattern still looks familiar: a central student system becomes the target, and the recovery question shifts to how long core services stay down.

The financial tail can also run long after an outage ends. Conduent agreed to pay $80 million to settle a breach affecting 62 million people, as our coverage of [that settlement](https://usa-24.com/conduent-settlement-payout-eligibility/) explains. Schools rarely face that scale, but the cost of notification, legal review and remediation starts accumulating quickly.

## RPS cybersecurity incident update: what to watch next

The 72-hour window runs through the weekend, which makes the next few days the first real test of the district's response. Three signals matter most. The first is whether the district confirms or rules out data theft. The second is whether any group posts material or claims responsibility. The third is whether the district gives a restoration date for phones, email and learning platforms.

A confirmed ransomware attack would move the story toward recovery costs and notification duties for families and staff. A quiet deadline would leave the district with a restoration timeline it still has to explain. Either way, the first official update that names a date for restored service will tell parents more than any ransom note has.

## Frequently asked questions

### Has Richmond Public Schools confirmed a ransomware attack?

Not according to most of the reporting. Cybernews says the district confirmed a ransomware attack across all 53 campuses, but Hoodline, WWBT and Dysruption Hub report that the district has not confirmed ransomware, data theft or the attacker's identity. Treat the ransomware label as disputed until the district says otherwise.

### When did the Richmond Public Schools internet outage start?

Staff first saw ransom messages on district-issued laptops on Wednesday morning, October 21, 2026. WWBT published its report that afternoon at 1:59 p.m. EDT. The district then took internet access offline across the division, and schools stayed open.

### Did Richmond Public Schools lose student data?

The district has not confirmed data theft. The attackers claim they took personal, financial and operational data, but no public statement from the district verifies that claim. Families should follow official district updates for any confirmation.

### What is the 72-hour deadline in the Richmond ransom message?

The attackers asked for contact within 72 hours and warned that unauthorized recovery attempts would cause permanent data loss. Cybernews reported that the messages threatened to leak data within that window. The deadline runs through the weekend.

### Should parents keep students' devices off school networks?

The district told students and staff not to connect personal devices to school networks. Keep personal devices off school networks until the district says they are cleared, and rely only on official district channels for updates.

## Sources

1. [Hackers knock Richmond schools offline, deface teachers laptops with ransom threats — Cybernews](https://cybernews.com/news/richmond-schools-ransomware-attack-ransom-note/)
2. [Cyberattack Knocks Out Phones, Email at 53 Richmond Public Schools — Hoodline](https://hoodline.com/2026/10/cyberattack-knocks-out-phones-email-at-53-richmond-public-schools/)
3. [Internet taken offline at Richmond Public Schools following cyberattack — WTVR](https://www.wtvr.com/news/local-news/richmond/richmond-public-schools-hit-by-cybersecurity-incident-students-told-to-stay-off-school-networks)
4. [Ransomware Attack Forces Richmond, Va., Schools Offline — GovTech (TNS)](https://www.govtech.com/education/k-12/ransomware-attack-forces-richmond-va-schools-offline)
5. ['Cybersecurity incident' at Richmond Public Schools causes internet shutdown — WWBT 12 On Your Side](https://www.12onyourside.com/2026/10/21/cybersecurity-incident-richmond-public-schools-causes-internet-shutdown/)
6. [Cybersecurity incident disrupts online systems at Richmond Public Schools — WRIC](https://www.wric.com/news/local-news/richmond/cybersecurity-incident-richmond-public-schools/)
7. [Cyber incident forces Richmond Public Schools in Virginia to shut internet access — Dysruption Hub](https://dysruptionhub.com/richmond-schools-cyber-incident/)
8. [Richmond Community Schools reports ransomware attack; Scranton School District paid ransom in March — DataBreaches.Net](https://databreaches.net/2024/09/29/richmond-community-schools-reports-ransomware-attack-scranton-school-district-paid-ransom-in-march/)