Wi-Fi, Phones, Cameras and Attendance, All at Once: An Inventory of What a Cyberattack Shut Off Across Richmond’s Public Schools
Richmond Public Schools in Virginia took its internet offline on Wednesday after staff found threatening messages on district laptops claiming data had been stolen. Classes continue without technology. Here is a list of what went dark, what is confirmed and what is only claimed, and what businesses can learn from it.
On Wednesday morning, staff at Richmond Public Schools in Virginia opened their district-issued laptops and found a message claiming the network had been compromised and sensitive information stolen. The message threatened to publish the data on a leak site unless the district made contact. By the afternoon, the district had taken its internet access offline, and a school system that runs almost entirely on connected technology was teaching without it.
This account is based on reporting by VPM News, with additional detail from The Richmonder and Cybernews.
The inventory: what went dark
Superintendent Jason Kamras said internet access was taken offline as a precaution, which limited phone and email service and access to online classroom tools. Sources who spoke to VPM News, and staff quoted by The Richmonder, described what that meant in practice:
- Connectivity: the district Wi-Fi network
- Communications: phones, including building landlines, and email
- Safety: security cameras
- Records: the PowerSchool portal, so teachers could not reach attendance records
- Everyday classroom tasks: making copies, writing hall passes and using smart boards
- Student devices: school-issued Chromebooks and digital assignments
- Testing: one source said PSAT testing at the high school level was affected
The district’s early-morning emails, sent to families and staff around 7 a.m., told everyone not to connect any device to district networks until further notice, from computers and iPads to interactive screens and personal phones. A teacher at Huguenot High School told VPM News the school had moved to “restrictive movement” inside the building.
What staff say the outage means
A Henderson Middle School English teacher who sits on the board of the Richmond Education Association told The Richmonder the disruption was a safety problem as well as an inconvenience: without the databases, staff could not reach a parent if a child had an allergic reaction or an injury. The union’s president told VPM News that attendance, copying, grading, projecting and logging in all depend on systems that were suddenly gone.
Confirmed vs. claimed
Confirmed by the district
- A cybersecurity incident is disrupting several operational systems.
- Internet access was taken offline as a precaution.
- Schools remain open for the rest of the week, with teachers moving to technology-free lessons.
- The district says student and staff safety is not affected.
- Outside cybersecurity experts and law enforcement are helping determine the scope.
Claimed or not yet known
- Whether any data was actually stolen. That claim comes from the attackers’ message, and the district has not confirmed it.
- Who is responsible. Cybernews reports that no ransomware group has been named.
- How the attackers got in, and when systems will come back.
- Whether student records were reached. Cybernews notes the district serves roughly 22,000 students, but it is unclear whether any student data was accessed.
The Richmonder also notes that nearby Hanover County Public Schools was hit in March, when, according to the division’s own investigation, an attacker got into its network data and tried to deploy ransomware.
What this means for your company
The list above could describe almost any office. Phones, door cameras, scheduling, records and email often share one network and one internet connection, so the decision to cut that connection, which is often the right call during an attack, switches everything off at once. Plan for that moment before it comes. Keep a printed contact list for staff, key customers and emergency contacts. Know which phone line or cell plan still works if your internet-based phone system is down. Decide in advance who can order a shutdown and how employees will hear about it. Then run a short tabletop exercise to find the gaps. Strong backups, multifactor authentication on remote access and network segmentation that keeps cameras and phones apart from office computers all reduce how much an attacker can take down in one move.
Need help building an outage plan and segmenting your network so one incident does not take every system down at once? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
