# Richmond Public Schools Offline for Days After Ransom Notes Appear

- URL: https://usa-24.com/richmond-public-schools-ransomware-attack/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-27T10:25:16.661Z
- Updated: 2026-10-27T10:25:16.666Z
- Topics: Ransomware, School Cybersecurity, Data Breach, PowerSchool, Richmond Public Schools

> Richmond Public Schools in Virginia has been offline for days after ransom notes appeared on staff laptops. The district has not confirmed data theft or named any attacker.

## Key takeaways

- Richmond Public Schools, which serves about 22,000 students across 53 campuses, lost internet, phone and email after ransom notes appeared on staff laptops on October 21.
- The laptop messages claimed attackers took data and demanded contact within 72 hours, but the district has not confirmed data theft or ransomware.
- By October 27, the disruption was in its fifth day, and many classrooms were relying on paper materials.
- The district is offering free credit monitoring to staff, students and families, and coverage does not state how long the offer lasts.
- Richmond, Virginia, is a different district from Richmond Community Schools in Indiana, which reported a ransomware attack in September 2025.

Staff at Richmond Public Schools in Virginia found ransom notes on school laptops on Wednesday, October 21. Internet, phone and email went down across all 53 campuses, and by October 27 the disruption was in its fifth day, [Cybernews reported](https://cybernews.com/news/richmond-oneonta-schools-ransomware-attacks/). The district has not confirmed that any data was stolen.

The district serves about 22,000 students, which places it among the 100 largest school divisions in the country. The messages on the laptops claimed the attackers had taken data and demanded contact within 72 hours, according to [Cybernews](https://cybernews.com/news/richmond-schools-ransomware-attack-ransom-note/) and [GovTech, citing the Richmond Times-Dispatch](https://www.govtech.com/education/k-12/ransomware-attack-forces-richmond-va-schools-offline). The district's own announcement on October 21 was far more measured, describing only "a temporary network disruption."

Richmond shut down its internet access, a step that also knocked out phone and email service, according to [GovTech](https://www.govtech.com/education/k-12/ransomware-attack-forces-richmond-va-schools-offline) and [Rankiteo](https://blog.rankiteo.com/ric1792621473-richmond-public-schools-cyber-attack-october-2026/). Staff and students were told not to connect devices to school networks, and the schools stayed open. Commentary in the coverage says isolating the network and restricting device connections matches standard response practice, the kind of containment security teams typically prioritize when they suspect an intrusion.

## Which systems are down and what parents are feeling

Hoodline reported that the incident affected the district's Wi-Fi, cameras, phones and the PowerSchool portal. Parents and teachers use PowerSchool for grades, attendance and student records, so the outage reaches well beyond the IT department. A school that cannot reach its student information system has to fall back on other ways to track who is in class and how students are doing.

Cybernews reported that staff are relying on paper materials in many classrooms. Whatever gets recorded on paper will likely have to be entered into digital systems later, which adds work for teachers who are already coping with the disruption. The district has not said how long full digital access, including PowerSchool, will take to return.

Superintendent Jason Kamras said the district is working with outside cybersecurity experts and law enforcement, according to Hoodline. According to Rankiteo, Kamras described the incident as a disruption to "several operational systems." The district is also offering free credit monitoring to staff, students and families while the investigation continues, though coverage does not say how long that offer runs.

## What the attackers claim, and what the district has not confirmed

The message on staff laptops came from an unnamed sender. Cybernews quoted it this way: "We have gained access to your network, extracted sensitive data, and encrypted your critical files." That is the attackers' account, not a verified one.

The district has not confirmed several points that matter most to families:

- Whether data was stolen, and which student or staff records might be involved
- Whether the incident is ransomware, as the messages claim, or another form of intrusion
- Who is responsible, since no group has been named or has claimed the attack
- Whether the district has paid or will pay a ransom, since no amount has been confirmed

The 72-hour window stated in the messages would have closed around October 24. Coverage does not say whether anyone at the district responded to the attackers.

## Ransomware or another intrusion? Why the label matters

The laptop messages are a strong signal, but a note on a screen does not prove what happened to the data. Ransomware generally means files were locked or encrypted, while data theft is a separate step that can happen alongside it. Districts often avoid firm labels early in an investigation, before forensic work confirms what was accessed, and that caution is understandable.

The distinction matters for families. Staff personal data could be in affected systems, and that kind of information is a common target for identity-theft fraud. Student records raise a different concern, because they can include contact details that scammers use to make phishing messages look legitimate. If data was taken, the number of people affected and the types of records involved will matter more than the ransom note itself.

## A wave of school attacks, and a different Richmond

Richmond is not the only school system hit this month. Cybernews reported that Oneonta City School District in New York canceled classes for two days after a separate ransomware attack, and the outlet covered both districts in one report on East Coast schools.

The pattern extends beyond schools to vendors that hold student and staff data. USA 24 has covered a [Frontline Education breach](https://usa-24.com/frontline-education-data-breach/) that exposed staff Social Security numbers and student records. Extortion crews have also kept pressing claims in other breaches, including the [Genesys incident](https://usa-24.com/genesys-data-breach-customer-data/), where a gang says it has more data.

Readers should keep this Richmond separate from Richmond Community Schools in Indiana. That district reported a ransomware attack and a PowerSchool-related breach in September 2025, according to [WDTN](https://www.wdtn.com/news/local-news/local-school-district-suffers-ransomware-attack/). The two cases involve different districts, different states and different years.

A bigger global story in the same window involved GMO Internet in Japan. Hackers reportedly demanded $50 million from a currency trading platform and threatened to leak customer data, according to [Bloomberg](https://bloomberg.com/news/articles/2026-10-26/japan-s-katayama-vows-to-address-cyber-attack-on-fx-with-urgency). That case has no direct US link, so it is not the focus here.

## What Richmond families and staff should do now

Parents should expect the district to contact them directly about any required actions, according to Hoodline. Until then, the steps below are general guidance, not instructions from the district.

- Treat unexpected emails, texts or calls about school accounts or grades as suspicious, even if they include real school details.
- Verify any request through the district's official phone line or website, not through contact details included in the message.
- Enroll in the free credit monitoring if you are a staff member, student or family member, and confirm the enrollment deadline with the district.
- Watch bank, credit card and credit report activity for charges or accounts you do not recognize.
- Consider a credit freeze if you believe your Social Security number was exposed. Freezes are free at the three national credit bureaus.
- Ask the district whether PowerSchool records were accessed and what it is doing to protect them.

## What to watch next

Three things will shape how serious this becomes: whether the district confirms data theft, whether a criminal group steps forward, and when PowerSchool comes back online. None of the three is settled. If the district confirms that records were taken, watch for a formal notice that states how many people were affected and which types of data were involved. A disruption that stretches past the first week would shift the story from an IT incident to a question about instruction time, grades and attendance records, and parents will press the district for answers on those timelines.

## Frequently asked questions

### Has Richmond Public Schools confirmed that student data was stolen?

No. As of the latest coverage, the district has not confirmed that data was stolen or that the incident is ransomware. The laptop messages claim attackers extracted sensitive data, but that is the attackers' account, not a verified finding.

### What systems are affected by the Richmond schools attack?

Hoodline reported the incident affected Wi-Fi, cameras, phones and the PowerSchool portal, which parents and teachers use for grades, attendance and student records. Cybernews said all 53 campuses were affected, and staff in many classrooms were relying on paper materials.

### Is free credit monitoring available to Richmond families?

The district is offering free credit monitoring to staff, students and families while the investigation continues. Coverage did not say how long the offer lasts, so contact the district directly to confirm enrollment steps and deadlines.

### Is this the same as the Richmond Community Schools attack in Indiana?

No. Richmond Community Schools in Indiana reported a ransomware attack and a PowerSchool-related breach in September 2025, according to WDTN. Richmond Public Schools is a separate district in Virginia.

## Sources

1. [Ransom notes hit Richmond school laptops after cyberattack](https://cybernews.com/news/richmond-schools-ransomware-attack-ransom-note/)
2. [Ransomware attacks disrupt East Coast school districts](https://cybernews.com/news/richmond-oneonta-schools-ransomware-attacks/)
3. [Ransomware Attack Forces Richmond, Va., Schools Offline](https://www.govtech.com/education/k-12/ransomware-attack-forces-richmond-va-schools-offline)
4. [Richmond Public Schools Cyberattack Disrupts Phones, Email](https://hoodline.com/2026/10/cyberattack-knocks-out-phones-email-at-53-richmond-public-schools/)
5. [Richmond Public Schools: hit by cybersecurity incident; students told to stay off school networks](https://blog.rankiteo.com/ric1792621473-richmond-public-schools-cyber-attack-october-2026/)
6. [Richmond Indiana schools ransomware attack](https://www.wdtn.com/news/local-news/local-school-district-suffers-ransomware-attack/)
7. [Trading Platform Rocked by Japan Hack, $50 Million Ransom](https://bloomberg.com/news/articles/2026-10-26/japan-s-katayama-vows-to-address-cyber-attack-on-fx-with-urgency)