Data tied to students and staff in Richmond Public Schools may now sit on the dark web. The school district learned this week that information taken in the cyberattack last month could have been posted online. Officials are working with law enforcement to confirm what happened.
The RPS suffered the initial attack on October 21, 2026. The impact disrupted the internet access throughout the district and cut off the phone and email communication. Schools remained open – but teachers and students were unable to use online devices and classroom sites.
What the district has confirmed
Superintendent Jason Kamras gave the update on Monday, November 9. He said the district learned that day that data improperly accessed during the incident may have appeared on the dark web.
Kamras said RPS is working with law enforcement to verify the claim and find out exactly what information was disclosed. He also said the district continues to work with outside cybersecurity experts, along with state and federal investigators.
The district has not said which specific systems the attackers reached. It also has not named the group behind the attack or said how much data the attackers stole.
The timing is significant. Nearly three weeks passed between the attack and the dark web warning. That gap is common in ransomware cases; this is because groups often wait before posting files. They use the delay to pressure victims into paying.
The dark web refers to the concealed & encrypted part of the internet. Users can only access it by using special web applications, and search engines do not. Criminals use it to sell stolen data. A posting there does not mean the whole district’s records are public. It means someone claims to hold them.
What parents and staff should know
RPS offered free credit monitoring to all staff, students, and families shortly after the attack. That offer remains available. The district has not said whether the dark web posting changes that offer or adds new services.
Families must be vigilant for odd messages that mention real school information. It is always harder to recognize a message that shares the name of a school or a teacher. In case someone encounters this kind of message, they should confirm through RPS before responding to it.
Both staff and students need to check their online accounts for suspicious behavior. Changing passwords for all the educational sites provides an extra level of protection. Using two-step verification is also helpful when it comes to protecting school accounts against unauthorized access.
Email privacy is another important concern for users today. This is especially relevant as Google has raised questions about whether Australia’s proposed legislation could affect access to Gmail, as discussed in our report on Google’s privacy concerns over the Australian bill.
Parents must have a conversation about the safety of kids with younger children. A leaked name or class detail could help a stranger sound credible. The kids must beware of sharing personal information with someone who reached out to them online.
Families need to keep all suspicious messages. Screenshots and time stamps of suspicious contact aid investigators in correlating the events. They also help the district understand how far the data has spread.
How the district responded
RPS shut off internet access across the district as soon as it detected the incident. This step aimed to stop attackers from reaching more data. The district then brought in outside cybersecurity firms and contacted law enforcement.
The FBI and Virginia State Police joined the investigation in the weeks after the attack. The district also set up an alternate network and handed out replacement devices to teachers.
According to Kamras, the district is devoted to transparency as it learns more information. He also recognized that families and staff trust the institution. However, he asked them to be patient during the investigation.
So far, the district has not clarified if it will inform families about the developments individually. As stated in Virginia law, schools must report any breach of personal data. Parents can also file complaints with the Office of the Attorney General in case they think that their data suffered improper handling.
The number of cyberattacks that schools encounter across the US is increasing every year. School districts possess a lot of personal data, including medical records of students. But budget restrictions make it impossible for lots of districts to employ dedicated security specialists. Those factors expose the schools & make them attractive targets for criminals.
