Staff at Richmond Public Schools in Virginia found ransom notes on school laptops on Wednesday, October 21. Internet, phone and email went down across all 53 campuses, and by October 27 the disruption was in its fifth day, Cybernews reported. The district has not confirmed that any data was stolen.

The district serves about 22,000 students, which places it among the 100 largest school divisions in the country. The messages on the laptops claimed the attackers had taken data and demanded contact within 72 hours, according to Cybernews and GovTech, citing the Richmond Times-Dispatch. The district's own announcement on October 21 was far more measured, describing only "a temporary network disruption."

Richmond shut down its internet access, a step that also knocked out phone and email service, according to GovTech and Rankiteo. Staff and students were told not to connect devices to school networks, and the schools stayed open. Commentary in the coverage says isolating the network and restricting device connections matches standard response practice, the kind of containment security teams typically prioritize when they suspect an intrusion.

Which systems are down and what parents are feeling

Hoodline reported that the incident affected the district's Wi-Fi, cameras, phones and the PowerSchool portal. Parents and teachers use PowerSchool for grades, attendance and student records, so the outage reaches well beyond the IT department. A school that cannot reach its student information system has to fall back on other ways to track who is in class and how students are doing.

Cybernews reported that staff are relying on paper materials in many classrooms. Whatever gets recorded on paper will likely have to be entered into digital systems later, which adds work for teachers who are already coping with the disruption. The district has not said how long full digital access, including PowerSchool, will take to return.

Superintendent Jason Kamras said the district is working with outside cybersecurity experts and law enforcement, according to Hoodline. According to Rankiteo, Kamras described the incident as a disruption to "several operational systems." The district is also offering free credit monitoring to staff, students and families while the investigation continues, though coverage does not say how long that offer runs.

What the attackers claim, and what the district has not confirmed

The message on staff laptops came from an unnamed sender. Cybernews quoted it this way: "We have gained access to your network, extracted sensitive data, and encrypted your critical files." That is the attackers' account, not a verified one.

The district has not confirmed several points that matter most to families:

  • Whether data was stolen, and which student or staff records might be involved
  • Whether the incident is ransomware, as the messages claim, or another form of intrusion
  • Who is responsible, since no group has been named or has claimed the attack
  • Whether the district has paid or will pay a ransom, since no amount has been confirmed

The 72-hour window stated in the messages would have closed around October 24. Coverage does not say whether anyone at the district responded to the attackers.

Ransomware or another intrusion? Why the label matters

The laptop messages are a strong signal, but a note on a screen does not prove what happened to the data. Ransomware generally means files were locked or encrypted, while data theft is a separate step that can happen alongside it. Districts often avoid firm labels early in an investigation, before forensic work confirms what was accessed, and that caution is understandable.

The distinction matters for families. Staff personal data could be in affected systems, and that kind of information is a common target for identity-theft fraud. Student records raise a different concern, because they can include contact details that scammers use to make phishing messages look legitimate. If data was taken, the number of people affected and the types of records involved will matter more than the ransom note itself.

A wave of school attacks, and a different Richmond

Richmond is not the only school system hit this month. Cybernews reported that Oneonta City School District in New York canceled classes for two days after a separate ransomware attack, and the outlet covered both districts in one report on East Coast schools.

The pattern extends beyond schools to vendors that hold student and staff data. USA 24 has covered a Frontline Education breach that exposed staff Social Security numbers and student records. Extortion crews have also kept pressing claims in other breaches, including the Genesys incident, where a gang says it has more data.

Readers should keep this Richmond separate from Richmond Community Schools in Indiana. That district reported a ransomware attack and a PowerSchool-related breach in September 2025, according to WDTN. The two cases involve different districts, different states and different years.

A bigger global story in the same window involved GMO Internet in Japan. Hackers reportedly demanded $50 million from a currency trading platform and threatened to leak customer data, according to Bloomberg. That case has no direct US link, so it is not the focus here.

What Richmond families and staff should do now

Parents should expect the district to contact them directly about any required actions, according to Hoodline. Until then, the steps below are general guidance, not instructions from the district.

  • Treat unexpected emails, texts or calls about school accounts or grades as suspicious, even if they include real school details.
  • Verify any request through the district's official phone line or website, not through contact details included in the message.
  • Enroll in the free credit monitoring if you are a staff member, student or family member, and confirm the enrollment deadline with the district.
  • Watch bank, credit card and credit report activity for charges or accounts you do not recognize.
  • Consider a credit freeze if you believe your Social Security number was exposed. Freezes are free at the three national credit bureaus.
  • Ask the district whether PowerSchool records were accessed and what it is doing to protect them.

What to watch next

Three things will shape how serious this becomes: whether the district confirms data theft, whether a criminal group steps forward, and when PowerSchool comes back online. None of the three is settled. If the district confirms that records were taken, watch for a formal notice that states how many people were affected and which types of data were involved. A disruption that stretches past the first week would shift the story from an IT incident to a question about instruction time, grades and attendance records, and parents will press the district for answers on those timelines.