Ransomware disrupted internet, Wi-Fi, Gmail and Google applications across Alamo Heights ISD from March 23 to March 27. The district later said personal information was accessed and potentially downloaded, affecting 26,629 people, and said no ransom was paid. WorldLeaks and Qilin posted separate victim listings, but the conflicting claims do not establish who caused the incident.
External sources identified the event as cyber-related before the organization publicly confirmed it. The organization publicly documents the resulting service disruption.
Malware that encrypts systems or data, typically accompanied by a ransom demand.
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
Data was made accessible to unauthorized parties through misconfiguration, system compromise, improper access controls, or another unintended condition.
Internal or external network connectivity was unavailable or materially impaired.
The organization lost or materially restricted internet connectivity.
Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.
Instruction, student services, school administration, learning platforms, transportation, or other educational operations were materially affected.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
An authoritative source stated that no ransom or extortion payment was made.
We reported that Alamo Heights ISD lost districtwide internet, Wi-Fi, Gmail and Google application access beginning March 23 while forensic specialists investigated. The district later confirmed ransomware, reported the matter to the FBI and restored systems March 27.
A later forensic review found that personal information was accessed and potentially downloaded. A Texas attorney general filing counted 26,629 affected people and identified names, Social Security numbers, driver’s license numbers, financial information and medical information among the affected data. The district notified affected people by mail, said normal operations had resumed and said it did not pay a ransom.
The outage affected school buildings and offices, restricted digital instruction and administration, and led the district to ask visitors to avoid campuses. Phone and door-security systems remained operational. The district’s March 27 restoration notice supports resolved operational status; the later breach notification does not extend the service-impact period.
The district’s current directory identifies seven facilities across Alamo Heights and San Antonio. The official mailing addresses use San Antonio throughout, but municipal-boundary and OpenStreetMap checks place the Central Office, Alamo Heights High School and Cambridge Elementary School in Alamo Heights; the junior school, Woodridge Elementary School and Howard Early Childhood Center are in San Antonio’s Oak Park neighborhood; and the Educational Development Center/Excel Academy site is in San Antonio near Crownhill Park.
The district’s finding supports unauthorized data access and exposure but does not establish which records were downloaded. WorldLeaks listed “Alamo Heights School District” April 1, and Qilin later listed the same name May 28. Those separate leak-site claims are concrete external cyber evidence, but neither listing authenticates the alleged data or proves that the claimant caused the March outage. Their conflict leaves actor attribution unresolved.
The district said it paid no ransom. Public reporting does not establish a demand amount, negotiation record or payment request from either claimant.
Confidence is high that ransomware caused the documented outage and that the district later confirmed unauthorized access to personal information. Actor confidence remains unresolved because the two stable claimant listings conflict and neither is authenticated by the district.
The initial access vector, precise encryption scope, confirmed exfiltration scope and responsible actor remain unresolved. The available evidence supports a resolved ransomware incident with a confirmed data breach, not confirmed attribution to WorldLeaks or Qilin.
Ransomware.live recorded a Qilin victim listing naming Alamo Heights School District on May 28. The stable listing identifies the claimant and victim name but does not authenticate alleged files, prove data theft or establish that Qilin caused the March ransomware disruption. The earlier WorldLeaks listing creates unresolved conflicting attribution.
Ransomware.live recorded a WorldLeaks victim listing naming Alamo Heights School District on April 1. The stable listing identifies the claimant and victim name but does not authenticate alleged files, prove data theft or establish that WorldLeaks caused the March ransomware disruption. A later Qilin listing creates unresolved conflicting attribution.
Oak Park is the San Antonio neighborhood containing the district's junior school, Woodridge Elementary and Howard Early Childhood Center; city is the closest supported locality tier for a neighborhood.
Districtwide Gmail, Wi-Fi and internet disruptions continued for several days while outside forensic specialists investigated.
The revised handbook identifies the Central Office, five school campuses and the Educational Development Center/Excel Academy, with official street addresses.
The district confirmed ransomware caused the outage and said internet and technology systems were restored Friday.
Ransomware.live recorded an April 1 WorldLeaks listing naming Alamo Heights School District. The listing does not authenticate alleged data or establish actor responsibility.
Ransomware.live recorded a May 28 Qilin listing naming Alamo Heights School District. The listing does not authenticate alleged data or establish actor responsibility.
The district said personal information was accessed and potentially downloaded in the March ransomware incident, normal operations had resumed, affected people were notified and no ransom was paid. A Texas attorney general filing counted 26,629 affected people.
Signed-in members can report an error, update, or missing source.
