Richmond Schools Probe October Cyberattack

A forensic audit is underway as the division works to restore systems still disrupted by the attack.

Updated on Nov. 11, 2026 in Cybersecurity

Richmond Schools Probe October Cyberattack

Live Poll

Do you trust your local public schools to protect student and staff data?

Richmond Public Schools has announced a forensic audit after a cyberattack that began in October 2025 took the entire division offline. The attack affected online classroom tools, phones and email, and continues to disrupt daily operations.

Why it matters

The division serves more than 22,000 students across over 50 sites, so prolonged disruption affects classroom instruction and school administration for families in Richmond. Data accessed during the incident may have been posted on the dark web, raising questions about the exposure of student and staff information.

Richmond Public Schools reports that the October 2025 cyberattack took its entire division offline across more than 50 sites serving over 22,000 students. The forensic audit and the full scope of any data exposure remain unresolved, and the district has not yet restored a permanent network.

The players

Richmond Public Schools

The public school division serving Richmond, Virginia, with more than 50 sites, over 22,000 students and over 4,000 teachers and staff, and the entity conducting the forensic audit after the cyberattack.

The details

The technology team has set up a temporary network, and teachers and students have been issued Chromebooks running on a server that was not compromised. The district is conducting a division-wide password reset and is rebuilding its server environment from recovery backup data with help from outside cybersecurity experts.

October 2025: Cyberattack began and took the division offline.
November 11, 2026: School board scheduled to receive an update on the forensic audit and investigation.

Threat Landscape

Richmond's outage follows a documented pattern of U.S. school districts losing classroom and communication systems for extended periods after cyberattacks. The district's reliance on a forensic audit and a rebuilt network reflects the same recovery path other districts have taken after similar incidents.

Families and staff should expect continued disruption to online classroom tools, phones and email while the temporary network remains in place. Everyone in the division will need to complete the password reset to regain access to district accounts.

The takeaway

Districts hit by cyberattacks often depend on temporary fixes for weeks, so families should keep an eye on official school communications and update their own passwords when prompted. Watch for the board's audit update to learn whether student and staff data was exposed.

What happens next

The school board is scheduled to receive another update on the forensic audit and on the data that may have been posted on the dark web on November 11, 2026.