Short answer
Richmond Public Schools in Virginia shut off internet access across its campuses on October 21, 2026 after ransom messages appeared on staff laptops. The district has not confirmed ransomware or data theft and says it is working with outside experts and law enforcement.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Richmond Public Schools |
|---|---|
| Incident type | Ransomware |
| Status | Under investigation |
| Sector | Education (K-12 school district) |
| Country | United States |
| Detected | 2026-10-21 |
| Disclosed | 2026-10-21 |
| People or records affected | Not stated. The district serves about 22,000 students across 53 campuses; whether any personal data was taken is unconfirmed. |
What data was exposed
- Unconfirmed. Ransom messages claim personal, financial and operational data was extracted, but the district has not verified this.
What happened
On Wednesday, October 21, 2026, Richmond Public Schools (RPS) in Virginia shut off internet access across its campuses after a cybersecurity incident. Phones, email and online learning tools were disrupted. Hoodline reported that all 53 campuses were affected and that about 22,000 students kept attending class.
Employees found messages on district laptops that morning. According to the Richmond Times-Dispatch, as summarized by GovTech, the note said the attackers had “gained access to your network,” extracted sensitive data and encrypted critical files. It set a 72-hour deadline to open a “secure chat for negotiation.” Those are the attackers’ claims. The district has not verified them.
Timeline
- October 21: Staff see the message. Superintendent Jason Kamras says internet access was taken offline “as a precaution” and that school continues as scheduled.
- October 21 to 22: Students and staff are told not to connect devices to school networks. Reports from VPM cited unnamed sources saying Wi-Fi, cameras, phones and the PowerSchool portal were affected.
- October 22 (Thursday): The outage enters a second day. WTVR reports in-person classes running “tech-free.”
How the district responded
RPS says it is working with outside cybersecurity experts and with local and federal law enforcement to learn the scope and source of the incident. It opened a command center, staffed 8 a.m. to 4 p.m., at 804-780-1849 and RPSCommand@rvaschools.net.
The district told WTVR it is working to determine whether personal information was affected. If it was, RPS said it will notify those people and offer free credit monitoring. Entry to buildings is limited to caregivers, and children go home only with adults already approved in PowerSchool.
What is still unknown
The district has not said whether data was stolen, whether files were encrypted, or whether a ransom was demanded. It has not named the attacker or given a date for restoring the network. WTVR also relayed an unverified message from a teacher who said some staff saw small, unexpected bank deposits. The district had not responded to that claim when the story ran.
What this means for families and staff
School districts hold names, addresses, birth dates and sometimes health or special education records, so even a rumor of a leak draws scammers. Expect fake messages that copy the district’s tone. Our guide to spotting phishing messages explains the usual signs, and what to do after a data breach covers credit freezes and account checks. Messages that demand a payment before a deadline follow the pattern described in our urgent payment scams guide.
We will update this page if the district confirms what was taken. For how we handle claims versus confirmed facts, see our editorial policy, and browse other incidents in the breach news archive.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake emails, texts or calls to parents claiming to be from the school district about 'student record verification', unpaid fees or tuition payments.
- Messages offering credit monitoring or identity protection that point to a look-alike sign-up page. Real offers come only through the district's own channels.
- Impersonation of district staff asking employees to 'confirm' payroll, direct deposit or login details after the outage.
- Scammers exploiting reports of small unexpected bank deposits by calling staff and asking them to 'reverse' the payment or share card details.
What to do if you are affected
- 01Contact the district command center line (804-780-1849) before acting on any message that mentions the incident.
- 02Do not click links or open attachments in messages about student records, payments or credit monitoring that you did not expect.
- 03Staff who see unexpected small deposits should report them to their bank and the district, and never send money back to an unknown sender.
- 04Staff should change passwords for any account reused between school systems and personal services, and turn on multi-factor authentication.
- 05Consider a free credit freeze with Equifax, Experian and TransUnion if the district later confirms personal data was taken.
Frequently asked questions
Was Richmond Public Schools hit by ransomware?
Employees saw on-screen messages claiming files were encrypted and data stolen, with a 72-hour deadline to contact the attackers. According to WTVR, the district has not confirmed that the incident is ransomware.
Was student or staff data stolen in the Richmond Public Schools cyberattack?
Not confirmed. The district said it is working with experts to find out whether personal information was affected. If it was, it said it would notify people and offer free credit monitoring.
Are Richmond Public Schools open after the cyberattack?
Yes. Superintendent Jason Kamras said schools stayed open, with lessons adjusted to work without internet. Entry is limited to caregivers, and children are released only to adults approved in PowerSchool.
Who is behind the Richmond Public Schools attack?
No group has been named. Cybernews reported that no ransomware gang has claimed responsibility.
What should Richmond parents watch out for after this incident?
Unexpected messages about student records, fees or credit monitoring. Contact the district through its published phone number or website instead of replying to the message.
Sources
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.