Ransom Notes on School Laptops: Richmond Schools Take Network Offline

The ransom notes appeared on school laptops on Wednesday morning. Staff at Richmond Public Schools in Virginia found on-screen messages claiming attackers had breached the network, stolen sensitive data, and encrypted critical files, with a 72-hour deadline to make contact. The Richmond schools ransomware attack forced the district to take its internet access offline, knocking out phones, email, Wi-Fi, security cameras, and the PowerSchool system across more than 50 schools serving roughly 22,000 students.

Richmond schools ransomware: what happened

According to reporting by Cybernews, GovTech via the Richmond Times-Dispatch, and the Richmonder, employees discovered the ransom notes on October 21, 2026. The message claimed the attackers had "gained access to your network, extracted sensitive data ... including personal, financial and operational information, and encrypted your critical files." It directed the district to a "secure chat for negotiation" within 72 hours.

The note carried the standard threats: do not attempt "unauthorized recovery" and do not involve third-party negotiators, or face "irreversible consequences, including permanent data loss." Whether any data was actually exfiltrated remains unconfirmed. As of October 22, the district had not confirmed any data theft, while the attackers claim otherwise. That gap between claim and confirmation is where these incidents live for their first week.

The district's response

Superintendent Jason Kamras confirmed the district had "temporarily taken Internet access offline" as a precaution, a drastic but correct move when you cannot yet scope an intrusion. Schools stayed open on a modified schedule, with staff working around the loss of phones, email, Wi-Fi, security cameras, and PowerSchool, the student information system schools depend on for attendance and grades.

Richmond Public Schools is working with outside cybersecurity specialists and law enforcement to determine the scope and restore systems. The attacking group has not been publicly identified, and single-source claims from leak sites were deliberately left out of the verified reporting, which is worth noting: in ransomware coverage, the first attribution is often wrong.

The Idaho parallel

Richmond is not an isolated incident. Days earlier, the Jerome School District in Idaho shut down all campuses for two days, October 19 and 20, after hackers infiltrated its network on October 17. In Jerome, the attackers reportedly seized control of security cameras, electronic door locks, and HVAC systems: not just data theft, but physical building control. Two school districts in two states, in the same week, both dealing with network intrusions serious enough to close or hobble schools.

Why schools keep getting hit

Schools are attractive targets for reasons that have nothing to do with technology and everything to do with structure. They hold sensitive data on tens of thousands of minors, which is valuable and heavily regulated, meaning breaches carry real legal exposure. They run on thin IT budgets with small security teams. And they cannot simply shut down for a week to rebuild: the pressure to restore systems quickly is exactly what ransomware operators count on.

The pattern is depressingly consistent with recent incidents. The Japan Times ransomware attack showed how a retired server could expose 20 years of data. The lesson from every one of these cases is the same: offline backups and an incident response plan decided in advance. Our 3-2-1 backup guide walks through making files ransomware-proof in an afternoon, and if you are on the receiving end of a breach notice, these are the seven things to do first.

The 72-hour deadline in Richmond is ticking. What happens next depends on backups the district may or may not have, and on negotiations the public may never see. For 22,000 students, the school week is already disrupted. That is the real cost, and it is why school ransomware keeps working as a business model.