Richmond, Virginia: Ransomware Message Forces Public Schools Offline as District Offers Credit Monitoring

Richmond Public Schools shut down internet access across the division on Wednesday, October 21, after employees found a threatening ransom message on school laptops, and the district was still working through the incident on Friday with schools open and investigators checking whether personal information was taken.

The message on the laptops

Multiple employees sent the Richmond Times-Dispatch images of on-screen messages that appeared on school laptops on Wednesday morning. The message claimed the senders had gained access to the network, extracted sensitive data, including personal, financial and operational information, and encrypted critical files.

The message gave the district 72 hours to make contact and have a secure chat for negotiation. Failure to act would bring severe repercussions, the message read, and it warned against unauthorized recovery attempts or involving third-party negotiators, saying such steps would lead to irreversible consequences, including permanent data loss. The district has not confirmed that any data was taken.

Superintendent Jason Kamras said in a Wednesday afternoon statement that the division had experienced a cybersecurity incident and had temporarily taken internet access offline as a precaution, limiting phone and email service and access to online classroom tools and learning platforms. School was proceeding as scheduled, he said, there was no threat to students or staff, and teachers were adjusting lessons and activities as needed. The division was working with outside cybersecurity experts and law enforcement to understand the full scope of the incident.

Schools stay open while systems come back piece by piece

Schools announced a divisionwide network outage on their websites at about 1:30 p.m. on Wednesday, and families were notified through the ParentSquare platform, Cybernews reported. Teachers and staff were told not to connect any devices to RPS networks, The Richmonder reported.

In a Thursday morning update, Kamras said the division was continuing to respond, school remained in session and internet access remained offline, but front office phones were online across the division. Outbound calls were never impacted, staff remained able to call emergency services, including 911, and ParentSquare was never impacted, he said. In a Thursday evening update, he said school security cameras were fully operational and local recording continued uninterrupted.

Credit monitoring offered, and the data question stays open

On Thursday evening, Kamras said the division will offer free identity and credit monitoring to all students and staff, with details on how to use the offer to be shared in the coming days. The district is working to determine whether personal information was affected, and Kamras said that if any information was impacted, the division will notify those affected, explain what it means for them, and offer free credit monitoring.

Cybernews reported that data on about 22,000 students across more than 50 Richmond schools could be at risk in the incident. The district has not confirmed a data theft, and on Friday officials were still investigating whether personal information was affected, according to the district updates reported by 12 On Your Side.