Oneonta City School District shut its doors to students on Friday and again on Monday, Oct. 26, after what administrators first thought was an internal technology glitch turned out to be a ransomware attack. The district said it is now working with a third-party cybersecurity firm to figure out whether any student records or personal information were exposed in the breach.
According to WBNG, district officials said what they initially believed to be internal technology issues has since been identified as a ransomware attack. The district's technology team acted immediately to implement measures designed to limit further unauthorized access and potential damage, and officials said they are following established incident response protocols while working closely with appropriate professionals and organizations, the station reported. Angela Brindley, the district's media coordinator, confirmed the ransomware attack in an email to WSKG, saying there was not yet enough information to determine whether student records or personal information had been compromised.
Brindley also said the district was still assessing the incident's full scope and impact and that additional information would be shared as verified details become available, per the same WSKG report. Binghamton Homepage reported separately that officials said the district is assessing the full scope and impact of the incident, language that echoes Brindley's own account of the investigation's early stage.
When the Attack Was Discovered
The cyberattack was discovered Thursday, Oct. 22, according to reporting by The Daily Star, which cited a letter to parents from Superintendent Thomas F. Brindley identifying the incident as a ransomware attack. That timeline lines up with the district's decision to close buildings to students the very next day and keep them closed through the following Monday.
Monday served as a superintendent's conference day, with staff reporting to their buildings to plan and prepare for the anticipated return of students on Tuesday, Oct. 27, per WBNG's reporting. CNY Homepage reported the district also shuffled its calendar as a result, moving its previously scheduled conference day from Thursday, April 30, to Monday, Oct. 26 — meaning April 30 will now be a regular school day. WBNG reported that students were expected to return Tuesday, Oct. 27.
What Stayed Open During the Shutdown
Not every district activity ground to a halt. CNY Homepage reported that all-day BOCES students continued attending their programs as usual, while morning and afternoon BOCES students did not attend programs on Friday or Monday. Athletic events scheduled for Oct. 23 and Oct. 26 went on as planned, the outlet reported.
A Growing Problem for Schools
Oneonta's shutdown fits into a broader pattern of cyber trouble hitting schools across New York. A 2023 New York State Comptroller report found that cyberattack and ransomware incidents statewide rose 53 percent between 2016 and 2022. More recently, Newsday found that statewide data-incident reports jumped 72 percent, from 384 in 2024 to 662 in 2025, with Long Island schools alone reporting 44 incidents in 2025, up from 35 the year before.
Nationally, the picture is just as stark. K-12 Dive reported that ransomware attacks against educational institutions rose 23 percent year over year in the first half of 2025, with 130 confirmed and unconfirmed attacks recorded in that six-month span and an average ransom demand of $556,000. The outlet also noted that 82 percent of U.S. K-12 schools experienced some kind of cyber incident between July 2023 and December 2024.
Other districts have faced far more disruptive breaches. A PowerSchool incident in late 2024 affected at least nine Long Island districts and an educational agency, according to Newsday, and K-12 Dive reported it allegedly exposed sensitive data from 10 million teachers and more than 60 million students nationwide. In Idaho, the Jerome School District — which serves about 4,000 students across eight K-12 schools — was forced to close for two days in October after hackers seized control of cameras, electronic locks, HVAC systems and network access, according to Cybernews, which reported that officials there would not confirm whether a ransom had been paid or was being considered.
No such details have emerged yet for Oneonta. The district has not said whether any ransom was demanded or paid, nor has it specified how many students, staff or devices were affected. For now, families are left waiting on the promised updates as the cybersecurity firm continues its assessment.
