Richmond Public Schools in Virginia shut off internet access across its 53 campuses after an intrusion left threatening messages on district-issued laptops. Staff saw the messages on Wednesday morning, October 21, 2026, and the disruption became public that afternoon. The district has not confirmed data theft, a named hacking group or ransomware, so the facts below may change before the weekend is over.

The ransom text is the most specific detail so far. As Cybernews reported, the message read in part: "We have gained access to your network, extracted sensitive data, and encrypted your critical files." It also demanded contact within 72 hours and warned that unauthorized recovery attempts would cause permanent data loss, according to a syndicated report on GovTech.

What the Richmond Public Schools cyberattack has confirmed

Superintendent Jason Kamras confirmed a cybersecurity incident that disrupted several operational systems, according to WTVR. The district sent a warning to students and staff at 8 a.m. telling them not to connect personal devices to school networks. In a statement quoted by Cybernews, Kamras said the network "was temporarily taken offline as a precaution."

Schools stayed open. The district said learning would continue in a technology-free environment, as WRIC reported. The district also says the safety of students and staff is not affected, according to WWBT and Dysruption Hub.

Timeline of the Richmond outage so far

  • Wednesday morning, October 21, 2026: Employees see threatening messages on district-issued laptops.
  • 8 a.m.: The district warns students and staff not to connect personal devices to school networks.
  • Wednesday afternoon: WWBT publishes its report at 1:59 p.m. EDT, describing an internet shutdown.
  • Following the shutdown: Phone and email service, online classroom tools and learning platforms are limited.
  • Through the weekend: The attackers' 72-hour window for contact runs.
  • Friday, October 23: No restoration date has been announced, and the district has not confirmed data theft.

The timeline shows a short gap between discovery and public disclosure, but a much longer gap between the outage and any answer about its scope. Parents and staff are still waiting on that answer.

Richmond Public Schools internet down: what stopped working

The outage reached well beyond email. Teachers could not access attendance records, make copies or use interactive classroom boards. Students could not use Chromebooks or reach digital assignments, according to Dysruption Hub. WTVR and WWBT both report that phone and email service was limited as well.

Hoodline went further. Its report said the outage also hit PowerSchool, the district's student information system, but the district has not confirmed that in its own statements, so treat the claim as unverified. If it holds, it would explain the attendance and grading problems teachers described, because those records typically sit in the student information system. That is an inference, not a finding.

The district has said some services may remain unavailable, according to WRIC, but it has not given a date. For families, that gap matters as much as any single outage detail, because it determines how long the school routine stays disrupted.

Which claims about the attack remain unconfirmed

Ransomware is the most disputed label. Cybernews says the district confirmed a ransomware attack across all 53 campuses. Hoodline, WWBT and Dysruption Hub report that the district has not confirmed ransomware, data theft or the attacker's identity. Until the district clarifies, readers should treat ransomware as a claim rather than a settled fact.

Data theft is the second open question. The attackers say they took personal, financial and operational data, but the district has not confirmed the theft. No group has publicly claimed the attack in the coverage reviewed.

GovTech and Dysruption Hub report that the district is working with cybersecurity experts and law enforcement, and that the FBI is reported to be investigating. Those reports do not say how far that work has progressed.

A ransom note can claim to have taken data without proving it, and a deadline works as leverage whether or not the threat is real. Those are two separate questions, and the district has not publicly answered either one.

Who is affected and what parents and staff should do

About 22,000 students are enrolled in the division. Their families and the staff at 53 campuses face disruption to classes, attendance, grading and communication. Cybernews places Richmond Public Schools among the top 100 US school systems by size, which makes this one of the larger districts to lose its network this year.

If you are a parent, a student or a staff member, these steps reduce risk while the investigation continues:

  • Follow official district updates only. Treat texts, emails or social posts that claim to come from the district with caution until they are confirmed through official channels.
  • Keep personal devices off school networks until the district says they are cleared.
  • Watch for phishing or follow-up extortion messages that claim to come from the district. Do not click links or send account, payment or banking details in response.
  • Staff who received a ransom message should keep screenshots and copies and pass them to the district's IT team or investigators. Incident responders generally advise keeping original messages rather than deleting them.
  • Do not try to recover files or contact the attackers on your own. The ransom note warned that unauthorized recovery attempts would cause permanent data loss.

For a general checklist after a breach that exposes account data, see our guide on what to do after the Capcom breach.

Why school districts keep getting hit

Schools hold large volumes of sensitive records on minors, staff and families, and many run lean security budgets. Expert commentary on other school attacks, cited in WRIC's coverage, has pointed to that funding gap. Nothing in the Richmond reporting ties this intrusion to a specific budget decision.

Richmond Community Schools in Indiana offers a useful comparison. In September 2024 it disclosed that student and staff information in PowerSchool had been breached in a ransomware attack, according to DataBreaches.Net. That was a separate incident with no link to the Virginia attack. The pattern still looks familiar: a central student system becomes the target, and the recovery question shifts to how long core services stay down.

The financial tail can also run long after an outage ends. Conduent agreed to pay $80 million to settle a breach affecting 62 million people, as our coverage of that settlement explains. Schools rarely face that scale, but the cost of notification, legal review and remediation starts accumulating quickly.

RPS cybersecurity incident update: what to watch next

The 72-hour window runs through the weekend, which makes the next few days the first real test of the district's response. Three signals matter most. The first is whether the district confirms or rules out data theft. The second is whether any group posts material or claims responsibility. The third is whether the district gives a restoration date for phones, email and learning platforms.

A confirmed ransomware attack would move the story toward recovery costs and notification duties for families and staff. A quiet deadline would leave the district with a restoration timeline it still has to explain. Either way, the first official update that names a date for restored service will tell parents more than any ransom note has.