Oneonta City School District ransomware timeline

Oneonta City School District closed its schools this month after a ransomware attack, and an anonymous email now claims the attackers took student records. The district, which National Center for Education Statistics data put at five schools and about 1,700 students in 2024-25, has not confirmed any data theft. The claim is unverified, and the story is still moving.

The attack was discovered on Oct. 21, according to the Oneonta Daily Star. Within a week, the district had closed schools twice and an anonymous email had claimed credit for the breach. Here are the key dates as reported:

  • Oct. 21: The attack is discovered.
  • Friday, Oct. 23: Schools close to students and staff.
  • Monday, Oct. 26: A conference day, with the closure extended to students.
  • Tuesday, Oct. 27: An anonymous email claims the attack for a group called Shiba.
  • Thursday, April 30: Becomes a regular school day as a makeup day. The reports do not name the year, so families should confirm the date on the district calendar.

Hoodline reported that the district shut schools twice, and WBNG reported the initial closure.

How the district described the attack

The district first believed it was dealing with internal technology problems. Superintendent Thomas Brindley later wrote to parents, in a letter cited by allotsego.com: “What we initially believed to be internal technology issues has since been identified as a ransomware attack.” That shift, from troubleshooting to a security incident, is the core of the timeline.

A district media coordinator, Angela Brindley, confirmed the attack by email to WSKG. She wrote: “We do not yet have enough information to determine whether any student records” The district's position on the question parents care about most is that it does not yet know.

The district said it was assessing the full scope of the incident and had not yet determined whether student records or personal information were compromised. It is working with a third-party cybersecurity firm to assess the attack, according to WBNG. Neither the full scope of disruption nor the date schools fully reopened appears in the reporting so far.

The stakes are real. School districts hold years of personal data, from enrollment and contact details to health and special-education files. That makes a student-information system an attractive target, and the list of people potentially affected can be far larger than the students in the building on any given day.

The Shiba claim and why it is unverified

On Tuesday, Oct. 27, an anonymous email sent to several media outlets claimed credit for the attack. It named the group “Shiba ransomware” and said the group stole Oneonta student records.

USA 24 could not independently verify that claim, and the district has not confirmed any data theft. An emailed claim is not evidence. Extortion crews have a reason to overstate what they took, because a bigger haul adds pressure on the victim. Ransom-group claims are not always accurate, so this one should be treated as unverified until the district or a forensic firm confirms what the data contains.

A forensic review is the most reliable way to test the claim, because it can show what was accessed on the district's systems. Until that happens, the Shiba email is the only claim in the reporting. Kaseya's weekly breach roundup reported that no ransomware group had claimed the Oneonta attack at the time it was written, which leaves the identity of the attackers open.

Richmond and Jerome show a wider pattern

Oneonta is not the only school system hit this month. Kaseya reported that Richmond Public Schools in Virginia confirmed a ransomware attack on Oct. 21. Teachers there found ransom notes on laptops, and Wi-Fi, PowerSchool and other systems were unavailable. Oneonta was hit separately, and no source in the reporting links the two.

In Idaho, the Jerome School District was hit by ransomware on Oct. 17. Superintendent Brent Johnson described the attack to Idaho EdNews: “This is a terrorist crime that happened to us.”

The broader trend is also measurable. According to WSKG, a 2023 New York State Comptroller report found that cyberattack and ransomware incidents in the state rose 53% from 2016 to 2022. One regional report, cited by allotsego.com, says school ransomware attacks have surged. It points to aging infrastructure, limited IT staffing and valuable student and staff data as reasons K-12 districts are often targeted.

Ransomware is not limited to schools. USA 24 has covered C3RB3R ransomware hitting Synology NAS devices running outdated DSM software, which shows extortion crews working through many kinds of organizations at once.

What parents and staff should do now

The district has not said what was taken, but several steps make sense now.

  • Watch for official notices. The next district update will be the first clear signal of whether any records left the district's systems.
  • Check what your child's record holds. Confirm whether it includes Social Security numbers or medical information, and ask the school what it keeps.
  • Freeze credit if a Social Security number breach is confirmed. A credit freeze is free and blocks new credit applications in your name. You place one with each of the three bureaus: Equifax, Experian and TransUnion.
  • Treat unexpected district emails with suspicion. Attackers often follow up with extortion or fake “notice” messages, so confirm any message by calling the number on the district's official website.
  • Ask IT about basic defenses. Staff can ask whether multi-factor authentication covers staff email and administrative systems, and whether offline backups are tested. The reporting does not confirm either step was taken in Oneonta.

Early breach totals can change. USA 24 has reported that an iRhythm breach is now listed at 8.2 million people on the HHS portal, a reminder that the first number in a breach story can move. Parents whose children attend other districts can ask the same questions: whether families have been notified, and whether a third-party vendor hosts the student-information system.

Open questions and what to watch next

Several questions remain open. The most important is whether the Shiba group holds Oneonta student data, and what that data includes. The district has not said when schools fully reopened, and the full scope of disruption is still unclear. An allotsego.com report also mentioned a city audit of its own IT systems, but the reporting does not establish whether that audit changed the district's response.

Watch three signals. First, a written update from the district that describes what was accessed, if anything. Second, findings from the third-party firm the district is working with. Third, whether the Shiba group publishes material that reporters can check. Until one of those arrives, the accurate account is that a New York district lost days of instruction, and its families do not yet know whether their children's records were taken.