Richmond Public Schools shut down internet access across the entire district on Wednesday after a cybersecurity incident disrupted phone service, email and online learning tools at all 53 of its campuses. Superintendent Jason Kamras said the district took its internet offline as a precaution while it worked to determine what happened, even as roughly 22,000 students kept showing up for class.
Laptops Flash Warning of Stolen Data
The disruption became public after multiple RPS employees encountered a message on their district-issued laptops Wednesday morning warning of a potential data breach, according to VPM News. The message claimed the district's network and sensitive information had been compromised and threatened to publish the allegedly stolen material on a leak site unless someone from the district made contact. The Richmond Times-Dispatch reported that the message went further, claiming attackers had gained network access, extracted sensitive personal, financial and operational data, and encrypted critical files — and warned that failure to act, or any attempt at unauthorized recovery or outside negotiation, would cause permanent data loss.
RPS itself has not confirmed those specifics. The station WTVR reported that the district could not confirm whether data had actually been stolen, whether files were encrypted, or whether the incident meets the definition of ransomware. That gap between what the laptop message alleged and what the district has verified remains unresolved as the investigation continues.
Schools Stay Open, Devices Told to Stay Off the Network
Despite the outage, Kamras said school is proceeding as scheduled for the rest of the week, with teachers adjusting lessons and activities as needed while technology access remains limited. The district also told staff and students not to connect any devices to school networks while the incident is under investigation, and said the breach is not affecting the safety of students or staff, per the same VPM report.
Sources familiar with the matter told VPM that the incident impacted the district's Wi-Fi network, cameras, phones and PowerSchool portal — the platform parents and teachers use to track grades, attendance and other student records. Richmond Public Schools is working with outside cybersecurity experts and law enforcement to understand the full scope of the incident, Kamras said, according to WRIC. He added that the district will share updates as information is confirmed and will communicate directly with anyone who needs to take action.
No Group Has Claimed Responsibility
Cybernews reported that the ransomware group responsible for the breach has not been named so far, and that the attack affected all 53 RPS campuses and approximately 22,000 students. Cybersecurity expert Alex Nette told WTVR that taking the network offline was consistent with standard protocol when a threat like this is detected, a move meant to contain further damage while investigators sort out what was actually accessed.
Part of a Rough Year for School Districts
Richmond's outage lands amid what cybersecurity researchers describe as a turbulent year for K-12 cybersecurity nationally. Comparitech recorded 34 ransomware attacks against U.S. educational institutions in the first half of 2026, a 44 percent decline from the 61 it tracked in the final six months of 2025, according to a report cited by GovTech. Worldwide, K-12 attacks fell 26 percent over the same period even as attacks on higher-education institutions rose more than 8 percent, and the U.S. accounted for a third of the 104 education-sector attacks Comparitech tracked globally. Of those, the firm said only 36 were confirmed while 68 remained unconfirmed — a reminder that school districts frequently spend weeks sorting fact from threat after an intrusion is first detected.
Other districts have faced longer disruptions this year. The same GovTech report noted that Alamo Heights Independent School District in Texas had its systems down for five days after a March ransomware attack that led to notification of more than 26,600 residents about a data breach, and that Delano Public Schools in Minnesota canceled classes for a day in May after an incident for which the extortion group LockBit later claimed responsibility and demanded $1.2 million. Cybernews also reported that the Jerome School District in Idaho shut down for two days after an October 17 cyberattack that knocked out cameras, electronic door locks and HVAC systems.
For now, Richmond Public Schools has not said how long the internet shutdown is expected to last, and the identity of whoever sent the laptop message remains unconfirmed. Kamras's pledge to communicate directly with anyone who needs to take action suggests families and staff should expect further word as the investigation, now involving outside cybersecurity experts and law enforcement, moves forward.
