Richmond Public Schools Ransomware Attack: A District Without Internet for Days

Part 3 of 8 in Recent Cyberattacks: Fall 2026 Briefings

On October 21, 2026, Richmond Public Schools in Virginia confirmed a cybersecurity incident that disrupted several operational systems and took internet access offline across the district, while schools stayed open (WTVR CBS 6, Oct 21). Staff shared images of ransom notes on school laptops, according to the Richmond Times-Dispatch (Richmond Times-Dispatch via GovTech). A day later, a district in upstate New York closed schools after its own attack (Cybernews). The cases show how much day-to-day operations now depend on the network, and why recovery planning matters as much as prevention.

Each item is linked to its source. Verification status reflects the strongest source available on the verification date.

What happened

1. Oct 21. The district tells students and staff not to connect devices to school networks and takes internet offline; schools remain open (WTVR CBS 6, Oct 21).
2. Oct 22. The Richmond Times-Dispatch reports ransom notes on laptops claiming data theft and setting a 72-hour deadline. These are the attackers’ claims, not confirmed facts (Richmond Times-Dispatch via GovTech).
3. Oct 22. Second day without internet; the district says it is working with local and federal law enforcement and will offer credit monitoring if personal data was affected (WTVR CBS 6, Oct 22).
4. Oct 22–27. Oneonta City School District in New York discovers an attack, cancels classes, and later confirms it is dealing with a group calling itself Shiba; the superintendent said the district had not seen specific evidence of the data theft the group claims (Cybernews; The Daily Star via GovTech).

Why school and public-sector attacks hit so hard

In Richmond, the outage reached phones, Wi-Fi, cameras and learning platforms, and dismissals relied on the student information system to confirm approved adults, according to local reporting (WTVR CBS 6, Oct 22; Cybernews). When one network carries safety, communication and instruction, an outage turns into an operational crisis within hours.

What is still unknown

How organizations can reduce ransomware impact

The CISA #StopRansomware Guide recommends, among other steps, offline encrypted backups, phishing-resistant MFA, prompt patching of internet-facing systems and a practiced incident response plan (CISA #StopRansomware Guide). In practice:

1. Keep encrypted, offline or immutable backups of critical systems and test restoring them on a schedule (CISA #StopRansomware Guide).
2. Separate safety systems (phones, cameras, door control) from the general network so one outage does not take everything down.
3. Require phishing-resistant MFA for remote access, email and admin accounts (CISA #StopRansomware Guide).
4. Patch internet-facing systems first, especially VPNs and firewalls (CISA #StopRansomware Guide).
5. Write and rehearse a plan that covers communication when email and phones are down (CISA #StopRansomware Guide).

More in this series

See all briefings and their verification status in the recent cyberattacks and data breaches tracker.

Sources

1. WTVR CBS 6, October 21, 2026 (updated October 31). https://www.wtvr.com/news/local-news/richmond/richmond-public-schools-hit-by-cybersecurity-incident-students-told-to-stay-off-school-networks
2. GovTech (Richmond Times-Dispatch), October 22, 2026. https://www.govtech.com/education/k-12/ransomware-attack-forces-richmond-va-schools-offline
3. WTVR CBS 6, October 22, 2026. https://www.wtvr.com/news/local-news/richmond/richmond-public-schools-operates-internet-free-for-second-day-after-cybersecurity-incident-hits-network
4. Cybernews, October 2026. https://cybernews.com/news/richmond-oneonta-schools-ransomware-attacks/
5. GovTech (The Daily Star, Oneonta), October 28, 2026. https://www.govtech.com/education/k-12/ransomware-group-claims-responsibility-for-oneonta-city-schools-hack
6. CISA, accessed November 1, 2026. https://www.cisa.gov/stopransomware/ransomware-guide