Richmond Public Schools Restores Networks After Cyberattack Exposes Personal Data

Richmond Public Schools (RPS) is restoring its network after a cyberattack disrupted servers and operational systems and resulted in personal information being posted on the dark web. The district confirmed that the exposed information relates to current and former students, employees, and contractors. RPS described the incident as a criminal act and said it understands the concern for people whose information may have been compromised. The breach also affected routine school operations, including printing, access to online classroom tools, and learning platforms. High school students reported that it interfered with college applications and transcript submissions.

The recovery challenge is substantial in scale. Chief Operating Officer Patrick Herrel said RPS serves more than 22,000 students and 4,000 teachers and staff across more than 50 sites. “Restoring an environment that complex has been an incredible task and the technology team has worked hard to bring RPS online,” Herrel said. The district established a temporary network, and Chromebooks operating on a separate server were provided to teachers and staff. Its technology team is working to create a permanent network and carry out a division-wide password reset, which RPS characterized as a common and recommended step after an incident of this kind.

RPS is conducting a forensic audit with federal officials and has said it cannot answer questions while the investigation is underway. The source reporting identifies the Federal Bureau of Investigation, its Cyber Crimes Division, Virginia State Police, the Virginia Cyber Fusion Center, and the Cybersecurity and Infrastructure Security Agency among the agencies associated with the response. RPS has also expanded its complimentary identity-monitoring service. Threat actors claimed they accessed a range of sensitive records, potentially including names, birth dates, phone numbers, addresses, driver’s license numbers, Social Security numbers, passport numbers, military identification numbers, health insurance numbers, and some medical information connected to educational or employment needs. The exact scope of confirmed data exposure remains under investigation.

For GovCon firms, the incident points to possible future requirements in incident response, digital forensics, network restoration, identity monitoring, and education-sector cybersecurity. However, no solicitation, contract award, procurement timeline, or currently open opportunity has been reported. Contractors should treat the event as market intelligence rather than an active bid notice, monitor RPS procurement channels for formal requirements, and assess whether their capabilities address recovery across a large, distributed K-12 environment. The reporting also notes that former technology services director Tim Tillman resigned on October 1, weeks before the incident; it does not establish a connection between his departure and the attack.

• RPS confirmed that personal information belonging to current and former students, employees, and contractors was posted on the dark web after last month’s cyberattack.
• The district operates across more than 50 sites, serving over 22,000 students and more than 4,000 teachers and staff, according to COO Patrick Herrel.
• RPS established a temporary network, supplied staff with Chromebooks using a separate server, and is working toward a permanent network.
• A division-wide password reset is underway; RPS described it as a common and recommended response to this type of incident.
• A forensic audit is underway with federal officials, and RPS says it cannot address questions while the investigation continues.
• Potentially affected data reported by threat actors includes personal identifiers and contact information, government identification numbers, insurance details, and some medical information; the confirmed scope was not stated.
• RPS expanded its complimentary identity-monitoring service for affected individuals.
• The reported response may point to future needs in incident response, network recovery, digital forensics, and identity monitoring, but no open procurement, award, or timeline has been reported.
• Contractors should monitor official RPS procurement notices and avoid treating the incident itself as evidence of an active solicitation.
• Tim Tillman, the former director of technology services, resigned on October 1, weeks before the incident; the reporting does not link his departure to the cyberattack.