The Oneonta City School District ransomware attack closed schools on Friday, October 23, and students will not return until Tuesday, October 27. The district has not yet said whether student or staff personal information was taken, which is the biggest open question.
The district serves about 1,700 students across five schools, according to 2024-25 enrollment data cited by Dysruption Hub. Staff first assumed the outage was internal technology trouble. Superintendent Thomas F. Brindley later identified it as ransomware in a letter to parents, as WBNG reported.
What happened in the Oneonta City School District ransomware attack
The Oneonta Daily Star first reported the story on Thursday, October 21, according to a Yahoo syndication of WUTR, WFXV and WPNY coverage. Another outlet says the attack was discovered on Thursday but does not give a date, so the exact discovery day is still unsettled.
Media coordinator Angela Brindley confirmed the attack by email to WSKG. She wrote that "the district is still assessing the full scope and impact of the incident."
The technology team has taken steps to limit further unauthorized access and possible damage, according to WKTV. Athletics were set to continue on Friday and Monday, while some BOCES programs were canceled, the station reported.
Which dates matter for students and families
Students and staff face different parts of the timeline, so the dates matter more than the headline suggests.
| Date | What happened |
|---|---|
| Thursday, October 21 | The Oneonta Daily Star first reports the attack |
| Friday, October 23 | Schools close for students and staff |
| Monday, October 26 | Staff conference day to plan the return; students stay home |
| Tuesday, October 27 | Students are due back in class |
Monday is the day to watch. The district has set it aside as a conference day for staff to plan students' return. Whether the Tuesday schedule holds depends on how quickly systems are restored, and the reporting does not describe how long that will take.
For families, the closure lands on daily schedules and childcare first. Local coverage of parent reactions, including WBNG's report, has focused on that day-to-day disruption.
What officials have confirmed and what remains open
The confirmed facts are narrow: schools closed, the district identified ransomware, and staff took steps to contain access. Officials have not confirmed whether student records or personal information were compromised. The district has said it will share verified details as they become available.
That gap matters because anyone whose personal data sat on the district's systems could be affected, from students to staff. Local, state and federal authorities are reportedly investigating, according to the Daily Star as cited by Dysruption Hub.
None of the reporting names a group behind the attack. Until investigators or the district say more, the identity of the attackers and the scope of any data theft remain unknown.
Why SafePay is the ransomware context to watch
The clearest recent warning comes from a joint CISA and FBI advisory, AA26-293A, dated October 20 and listed on CISA's advisories page. According to a Le-VPN roundup of the week's security news, the advisory names SafePay, which has hit at least 600 organizations since August 2024 and destroys online backups.
Nothing in the Oneonta reporting ties this attack to SafePay, so the advisory is context, not confirmation. It does show what a district should be ready for: an attacker that can erase recovery options turns a cyber incident into a long outage.
The same week brought the attack on Richmond Public Schools, which affects all 53 of its campuses. Cybernews reported that ransom messages were left on district laptops and that the district remained offline. Two district attacks in one week suggest schools are a recurring target.
Backups are where this story could turn. When attackers destroy online backups, restoration takes longer, and districts often stay shut while systems are rebuilt. Oneonta's district has not said whether its backups were affected, so that answer is still missing.
What school IT teams and families should do now
The advisory's main mitigation is to keep backups offline or immutable, so attackers cannot erase them. The other steps below are general precautions rather than guidance drawn from the cited sources.
- For IT staff and administrators: keep backups offline or immutable, the mitigation the CISA and FBI advisory points to.
- For IT staff: test restores on a regular schedule so recovery time is known before an incident.
- For parents and staff: expect notification from the district if it confirms that personal data was compromised.
- For parents and staff: treat unexpected emails or texts that claim to come from the district as possible phishing, and verify them through official channels.
- For parents and staff: follow official district updates rather than social media posts for reopening news.
Attackers often go after access long before they encrypt anything. USA 24 has reported on ransomware crews using a Palo Alto PAN-OS flaw to reach domain credentials, which shows how that access can be gained.
What comes next for Oneonta's return to class
Tuesday is the first real test. If students return on October 27, the district will have restored enough systems to run a school day, and families will get a clearer picture. If the date slips, the district will need to explain the delay and say when classes will resume.
The data question will move more slowly. The district has promised verified details but has not set a date for them, and any notification will depend on what investigators confirm. Watch for a written update that says whether backups were affected, because that answer will shape how quickly the district can recover.
Oneonta's closure is short, but the sequence is familiar: an attack that first looks like a technical glitch, a closure announced within days, and a data answer that takes longer than the return to class.
