The Richmond Public Schools ransomware attack reached every corner of the district. According to reporting from Cybernews, all 53 campuses were affected, and hackers left ransom notes on staff laptops threatening to leak stolen data within 72 hours.

The details available so far are limited, and the district's investigation is ongoing. But the combination of a district-wide disruption and a countdown to a data leak is a textbook example of how modern ransomware works, and it carries lessons for anyone connected to a school system.

What happened at Richmond Public Schools

Richmond Public Schools says the attack hit all 53 of its campuses. Hackers displayed ransom notes on staff laptops, a tactic meant to make the incident impossible to ignore and to pressure decision-makers quickly. Local coverage has also reported that the district's internet access went offline after the incident and that students were told to stay off school networks.

The notes reportedly threaten to leak stolen data within 72 hours. That detail matters, because it tells us the attackers claim to have copied information out of the district's systems, not just locked files. We do not yet know what specific data was taken, whether the claim is accurate, or which group is responsible. Those questions remain open, and readers should treat unconfirmed claims with caution.

The visible ransom note is also a reminder that the moment staff see one is rarely the start of the attack. Attackers often spend time inside a network before triggering the final stage. Our piece on how to detect ransomware early explains why the signs often appear well before a note shows up on screen.

What the 72-hour leak threat means for staff and families

A 72-hour deadline is a pressure tactic. It is designed to shrink the time an organization has to think, consult lawyers, and coordinate with law enforcement. For a district with 53 campuses, that pressure is intense.

For the people connected to the district, the real concern is the data itself. School systems typically hold records on employees, students, and families. If any of that material was copied and is later published, it can be used for phishing, identity fraud, or targeted scams. We do not know yet which records, if any, are involved, so the safest approach is to prepare without assuming the worst.

The question of whether to pay is separate and complicated. As our explainer on ransomware payment rules and OFAC risk notes, there is no federal statute that categorically bans paying a ransom, but legal exposure still exists. Local reporting on the Richmond incident also notes that the FBI advises schools not to pay and to contact the bureau immediately. Paying also offers no guarantee that stolen data will be deleted.

Why backups alone don't stop double extortion

For years, the standard advice was to keep good backups so you could restore systems without paying. That works against encryption, but it does nothing about stolen data. In a double-extortion attack, criminals both lock systems and copy files, then threaten to publish them. A clean restore gets the schools running again, yet the leak threat remains.

That is why the 72-hour note is so significant. Even if Richmond Public Schools can recover its systems, the attackers are signaling that they hold something they can release. Our guide on why backups aren't enough against double extortion walks through this shift in detail.

The visible note is also part of the tactic. Other groups have used unusual delivery methods to maximize disruption, as seen when INC ransomware printed ransom notes on hospital printers. The goal is the same: force a fast, stressful decision.

What This Means For You

If you work for, attend, or have children in Richmond Public Schools, there is no need to panic, but it is sensible to be careful. Official updates from the district are the most reliable source. Be skeptical of any message claiming to be from the district, a vendor, or the attackers that asks you to click a link, log in, or send money.

If you are connected to another school district or any organization that holds personal data, this incident is a prompt to review your own readiness. Data theft is now a standard part of ransomware, so protecting information matters as much as protecting uptime.

Steps staff and parents can take now

  • Reset passwords for any district-related accounts, and for any other account where you reused the same password.
  • Turn on multi-factor authentication wherever it is offered, especially for email and financial accounts.
  • Watch for phishing by email, text, or phone. Messages that reference the incident or urge quick action are red flags.
  • Verify before you act. Contact the district through official channels rather than replying to unexpected messages.
  • Monitor your accounts for unusual activity, and consider a credit freeze if you are notified that sensitive information was exposed.
  • Keep devices updated and avoid using district-issued laptops for personal logins until the district gives the all-clear.

Key takeaways

The Richmond Public Schools ransomware attack shows how quickly a single incident can spread across an entire district, and how a 72-hour leak threat shifts the risk from downtime to data exposure. Much remains unconfirmed, so rely on official updates.

If you are tied to an affected district, or you manage personal data anywhere, reset your credentials, enable multi-factor authentication, and stay alert for phishing. For deeper context on why restoring from backups does not end the threat, read our double extortion explainer.