Skip to content

Radford City Public Schools cyber incident

Summary

Radford City Public Schools logo

A June 2025 cyber incident disrupted internal systems at Radford City Public Schools while summer-school classes and safety systems continued. A later INC Ransom claim remains unconfirmed; full recovery is undated.

Key facts

Timeline

  • First public signal:
    ? Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity.
  • First public cyber evidence:
    ? Earliest credible public information connecting the incident or disruption to malicious cyber activity.
  • Official cyber disclosure:
    ? First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related.
  • Last impact seen:
    ? Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.

Primary victim organization

Impacted locations

Organization types

Critical infrastructure sector

Incident characteristics

Assessments

Attack mechanisms

  • Data extortion

    Threats to publish or sell stolen data without evidence of encryption.

Data impacts

  • Unknown data impact

    The incident is cyber-related, but available evidence does not establish whether or how data was affected.

Operational impacts

  • Phone service disruption

    Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.

  • Internal systems unavailable

    Internal business, administrative, operational, or staff-facing systems were unavailable.

  • Educational operations disrupted

    Instruction, student services, school administration, learning platforms, transportation, or other educational operations were materially affected.

Extortion indicators

  • Public leak threat

    The actor explicitly threatened to publish or publicly release victim data or incident details.

  • Leak-site listing

    The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.

Incident narrative

Analyst assessment

Radford City Public Schools disclosed a cybersecurity incident affecting its network on June 10, 2025. The superintendent’s letter, reproduced by the News Journal, acknowledged disruption to internal IT systems and a restoration effort involving outside specialists and state and federal law enforcement. This is separate from the later City of Radford government incident.

Operational significance

Our June 16 reporting described interruptions to central-office telephone and livestreaming functions. The superintendent said summer-school classroom learning continued and safety-related systems, including cameras, access-controlled doors and phone lines, remained operational. The evidence supports an internal administrative technology disruption, without establishing school closures or a loss of campus safety systems.

Contemporary reporting described restoration work still underway. It did not provide a complete system inventory, the start of unauthorized access or a verified date when every affected function returned. Operational impact is presumed resolved because the reviewed evidence contains no recent continuing service loss; an exact end date remains unknown.

Confidence and uncertainty

Confidence is high that a cyber incident disrupted internal systems because the school division acknowledged both. On June 16, Superintendent Adam Joyce told the News Journal that student data was stored separately and had not been breached. That finding concerns student information and does not establish the status of all staff or administrative data.

A later ransomware.live listing names Radford City Schools and its verified domain, rcps.org, under INC Ransom. The tracker recorded discovery Aug. 1, 2025, and reports a threat to publish an alleged 100 GB of sensitive, medical and personal data. This supports a qualified same-entity claim, but does not independently establish that INC Ransom caused the June outage or that its theft, volume and data-category assertions are accurate.

Analytic gaps

The initial access method, encryption, payment, full data scope and precise restoration date remain unverified. The later claim does not independently overturn the superintendent’s student-data finding. No original files or purported samples were authenticated, and the listing’s original publication date and associated attack date remain unknown.

The June 10 family notice is the supported disclosure date; our original article’s June 11 date differs from the letter chronology reported locally. Further primary evidence is needed to reconcile the specific central-office telephone interruption with the statement that safety-related phone lines continued operating.

Threat actor and claim

Listed as: Radford City SchoolsSource: ransomware.liveDiscovered:

Claim details

Tracker reports an INC Ransom listing naming Radford City Schools and its verified domain rcps.org, threatening publication of an alleged 100 GB of sensitive, medical and personal data. Same entity identity is supported; responsibility for the June 2025 incident, theft, volume, data categories and encryption are unconfirmed. Discovery date is not attack or original publication date.

Organizations involved

Impacted location

  • Radford, Virginia

    Location of school division offices and schools.

    School division jurisdiction coincides with Radford city; specific internal-system effects documented, not an area-wide outage.

Sources

Radford City, Va., Schools Hit by Cyber Attack

Superintendent acknowledged network incident and internal-system restoration; summer-school classroom learning and safety systems continued.

Radford City Schools Experiences Cyber Attack

Local report reproduces June10 superintendent letter; on June16 he said separately stored student data was unaffected.

INC Ransom claim naming Radford City Schools

Tracker lead names Radford City Schools and rcps.org and reports a threat to publish an alleged 100 GB of sensitive data.

See something that needs correction?

Signed-in members can report an error, update, or missing source.