12 November 2026: Richmond Public Schools confirmed that personal information tied to the 21 October ransomware attack was posted on the dark web. The district is widening free Experian monitoring to former students and employees. See the Richmond Public Schools breach record.
Axios reported the update on Wednesday. The district said affected systems contained Social Security numbers, addresses, driver licence numbers, health insurance details and other medical information. It has not said which of those fields were in the dark-web post, and it has not published a people count.
What happened in the Richmond Public Schools ransomware attack?
On the morning of 21 October, families were told not to log into district devices. By afternoon the network was down. Schools stayed open. Wi-Fi, phones, email, PowerSchool and student Chromebooks were disrupted. Superintendent Jason Kamras said the shutdown was a precaution and that student and staff safety was not affected.
Cybernews published the ransom note. It claimed stolen personal, financial and operational files and gave a 72-hour contact window. The district has not named a group. Interlock listed the district on leak-site mirrors on 9 November. That listing is still an unverified brand claim on top of a confirmed incident.
The FBI, Virginia State Police and federal cybersecurity officials are assisting. The district is rebuilding from backups and rewriting security policy. The Queens Public Library ransomware row is a same-season school-adjacent outage with no census.
What data was exposed?
Until 12 November the district had not confirmed that any records left the building. Axios now says it confirmed a dark-web posting and is offering monitoring to former students and employees as well as current ones. The systems that were reached held SSNs, addresses, licences and health data. That is an inventory of what those systems stored, not a confirmed dump field list.
22,000 enrolled students is the district size, not a leak count. recordsAffected stays 0 until a named census appears. Do not download alleged student files. This catalog does not link them.
The Lake County Schools post is a different Florida disclosure from a records-request error, not ransomware.
Who is affected?
Current students, staff and contractors were already in the first notices. The 12 November update adds former students and former employees because the attacker claimed those files too. How far back the records go is unpublished. Neighbouring districts such as Henrico, Chesterfield and Hanover are not automatically in this row.
Families who never used Richmond Public Schools are outside this incident. People who left the district years ago should still read the Experian offer. More on the organisation is on the Richmond Public Schools company page.
What should Richmond families do?
- Enrol in the district Experian offer if you are a current or former student or employee. The window runs through 26 February 2027.
- Call 877-753-3334 weekdays 9 a.m. to 9 p.m. if the portal is unclear.
- Place a free credit freeze at Equifax, Experian and TransUnion if an SSN may have been in the files.
- Treat texts that mention a child's school, teacher or bus route as hostile unless you started the contact.
- Compare later mail with rvaschools.net. The district will not collect a card CVV through a restore page.
The Frontline Education post is a vendor path that hit other districts, not this network.
Did Interlock do this?
Unknown. The district has not named a brand. Interlock listed Richmond Public Schools on 9 November. Ransomware notes often share wording. Similar language is not proof. Catalog the confirmed outage and the confirmed dark-web posting. Keep the Interlock name in the actor column until the district or a regulator says otherwise.
Frequently asked questions
Did Richmond Public Schools confirm a data leak?
Yes, as of 12 November. Axios reported the district confirmed personal information was posted on the dark web. It still has not published which fields were in that post or how many people are involved.
How many students were affected?
Unpublished. About 22,000 students attend the district. That is not a leak count. recordsAffected stays 0.
Were schools closed?
No. Schools stayed open on 21 October. Online tools and phones were limited.
Is PowerSchool the source of the leak?
Not established. PowerSchool was offline because the district network was down. The district has not said PowerSchool records were copied.
What is the Experian deadline?
26 February 2027, according to Axios. The new call centre is 877-753-3334.
Sourcing note: 21 October outage from VPM and Cybernews. Dark-web confirmation, field inventory, former-student monitoring and Experian dates from Axios 12 November 2026.