Hackers knock Richmond schools offline, deface teachers laptops with ransom threats
"We have gained access to your network, extracted sensitive data, and encrypted your critical files."
Richmond Public Schools Safe School Zone sign. Image by ArtByArthur | Shutterstock
Follow us
- Richmond Public Schools took its network offline after a ransom note appeared on staff laptops.
- Hackers claim they stole sensitive information, but the district has not confirmed data theft.
- Schools remained open, with limited access to phones, email, Wi-Fi, cameras, and PowerSchool.
- Data on 22.000 students across more than 50 Richmond schools is now at risk.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
Richmond Public Schools in Virginia are forced offline after hackers deface teachers' laptops with ransom demands and threaten to leak an unknown amount of sensitive data if the district doesn't contact them within 72 hours.
K-12 Schools in the state's capital began announcing the “divisionwide network outage” on their websites around 1:30 p.m. ET Wednesday, also notifying student families through the district’s ParentSquare platform feed.
Richmond Public Schools is currently experiencing a temporary network disruption. Our Technology Services team is working to address the issue,Richmond Public School stated in a public announcement.
Hackers plaster laptops with ransom threats
Richmond Public Schools serves approximately 22,000 students across 53 campuses, making it one of the top 100 largest school divisions in the US. All 53 campuses have been impacted.
The district first became aware of the attack Wednesday morning after employees reportedly discovered threatening messages splashed across their district-issued laptops.
In the note, the unnamed hackers claim they broke into the network and stole an unknown amount of sensitive information, “including personal, financial, and operational information.”
The group, which also chided the district for “inadequate security measures,” is now threatening to publish the compromised data unless the district contacts the group within 72 hours to negotiate.
We have gained access to your network, extracted sensitive data, and encrypted your critical files. This situation demands immediate attention from your leadership team,the unknown ransomware group wrote.
The cybercriminals also warned RPS not to attempt unauthorized recovery or involve third-party negotiators.
“Such actions will lead to irreversible consequences, including permanent data loss,” the attackers said.
Interestingly, according to some Redditors, the ransom note appears to share characteristics and wording with notes used by both the Interlock and Anubis gangs, although similar templates are often shared across the ransomware ecosystem.
Schools stay open as systems go dark
At 7:00 a.m. ET, parents and school employees were emailed instructions not to log into devices or platforms or connect to the district’s network while the technology issue was being investigated.
By the afternoon, another email warning of an attack and subsequent system shutdown was sent to all teachers and staff, according to Virginia’s local PBS affiliate, VPM News.
Richmond Public Schools Superintendent Jason Kamras also put out a statement to say that "the network was temporarily taken offline as a precaution" and to help the remediation process.
Even though Kamras warned of “limited phone and email service, as well as access to online classroom tools and learning platforms,” school was not canceled, and teachers were “adjusting lessons and activities as needed.”
School is proceeding as scheduled. The incident is not affecting the safety of students or staff,Richmond Public Schools Superintendent Jason Kamras said in a statement.
RPS officials told parents that schools would remain open for the rest of the week, calling it a "shift to a technology-free learning environment."
Sources told VPM that the attack had also impacted the district’s Wi-Fi network, school cameras, the PowerSchool education portal, and that students are unable to use their school-issued Chromebooks.
Check if your data was exposed
Find out if your email and related personal information have appeared in known data breaches.
Teachers are reportedly also blocked from accessing attendance records, making copies, writing passes, or using their smart boards.
"We understand that these disruptions create challenges for our entire school community. Our priorities are supporting our students and staff, understanding what happened, and restoring affected systems securely," Kamras said.
Ransomware keeps coming for schools
The district has not confirmed the theft of any data as of Wednesday evening.
Kamras says the RPS is working with law enforcement and has brought in outside cybersecurity specialists to determine the scope of the incident and restore systems securely.
If the name PowerSchool sounds familiar, the world's leading K-12 cloud software provider is no stranger to ransomware attacks.
Serving over 60 million students in 18,000 school districts across North America and beyond, the EdTech platform was hit by hackers at the end of 2024.
PowerSchool decided to pay its attackers, only to find the cybercriminals moving on to extort their customers – the actual schools using the software.
Earlier this week, another school-related breach was unfolding in Idaho.
The Jerome School District was forced to shut down for two days after hackers infiltrated its network on October 17th and took control of school surveillance cameras, electronic door locks, and HVAC systems.
