Analyst assessment
Radford City Public Schools disclosed a cybersecurity incident affecting its network on June 10, 2025. The superintendent’s letter, reproduced by the News Journal, acknowledged disruption to internal IT systems and a restoration effort involving outside specialists and state and federal law enforcement. This is separate from the later City of Radford government incident.
Operational significance
Our June 16 reporting described interruptions to central-office telephone and livestreaming functions. The superintendent said summer-school classroom learning continued and safety-related systems, including cameras, access-controlled doors and phone lines, remained operational. The evidence supports an internal administrative technology disruption, without establishing school closures or a loss of campus safety systems.
Contemporary reporting described restoration work still underway. It did not provide a complete system inventory, the start of unauthorized access or a verified date when every affected function returned. Operational impact is presumed resolved because the reviewed evidence contains no recent continuing service loss; an exact end date remains unknown.
Confidence and uncertainty
Confidence is high that a cyber incident disrupted internal systems because the school division acknowledged both. On June 16, Superintendent Adam Joyce told the News Journal that student data was stored separately and had not been breached. That finding concerns student information and does not establish the status of all staff or administrative data.
A later ransomware.live listing names Radford City Schools and its verified domain, rcps.org, under INC Ransom. The tracker recorded discovery Aug. 1, 2025, and reports a threat to publish an alleged 100 GB of sensitive, medical and personal data. This supports a qualified same-entity claim, but does not independently establish that INC Ransom caused the June outage or that its theft, volume and data-category assertions are accurate.
Analytic gaps
The initial access method, encryption, payment, full data scope and precise restoration date remain unverified. The later claim does not independently overturn the superintendent’s student-data finding. No original files or purported samples were authenticated, and the listing’s original publication date and associated attack date remain unknown.
The June 10 family notice is the supported disclosure date; our original article’s June 11 date differs from the letter chronology reported locally. Further primary evidence is needed to reconcile the specific central-office telephone interruption with the statement that safety-related phone lines continued operating.