Richmond Community Schools
Ransomware disrupts Richmond Community Schools in Indiana
Summary
Richmond Community Schools in Indiana said a Sept. 27, 2024, ransomware attack breached student and staff information held in PowerSchool. It shut its data-services network, announced a two-hour delay and canceled morning half-day preschool for Sept. 30, and prepared low-tech lessons. Parent-teacher conferences were subsequently canceled. A Dec. 4 district statement said climate control had continued, but ransomware had made maintenance repairs and monitoring harder. The reviewed evidence does not establish a named attacker, verified data-copying scope, a ransom demand or an exact recovery date.
Key facts
Timeline
-
Incident start:
?
Earliest known or assessed start of malicious activity or incident activity. -
First public signal:
?
Earliest public indication of an outage, disruption, closure or other observable incident impact. The signal does not need to mention cybersecurity. -
First public cyber evidence:
?
Earliest credible public information connecting the incident or disruption to malicious cyber activity. -
Official cyber disclosure:
?
First official acknowledgment by the affected organization or an authoritative public body that the incident was cyber-related. -
Last impact seen:
?
Latest public indication that disruption, degraded operations, recovery work or unresolved impact was still ongoing.
Primary victim organization
Impacted locations
Organization types
Critical infrastructure sector
DysruptionHub coverage
Incident characteristics
Assessments
Attack mechanisms
-
Ransomware
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Data impacts
-
Unauthorized data access
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
Operational impacts
-
Network outage
Internal or external network connectivity was unavailable or materially impaired.
-
Educational operations disrupted
Instruction, student services, school administration, learning platforms, transportation, or other educational operations were materially affected.
-
Delayed opening or early closure
The organization delayed opening, closed early, or reduced operating hours because of the incident.
-
Event or activity cancellation
Scheduled events, meetings, hearings, classes, procedures, programs, or other activities were canceled.
-
Manual workaround required
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
-
Staff unable to work normally
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
Extortion indicators
-
Unknown extortion indicators
The incident may involve extortion, but available evidence does not establish which extortion indicators were present.
Incident narrative
Analyst assessment
Richmond Community Schools in Indiana said ransomware targeted its data-services network on Sept. 27, 2024. Its Sept. 28 notice acknowledged a breach of student and staff information housed in PowerSchool and a network shutdown during investigation with local, state and federal agencies. The initial intrusion time remains unknown.
The district’s explicit acknowledgment supports high ransomware confidence. It does not establish the intruder’s identity or access method. Its statement that there was no then-current evidence of misuse should not be read as proof that information was untouched or that no later misuse occurred.
Operational significance
The district announced a two-hour delay for Sept. 30, later bus runs and cancellation of morning half-day preschool. Staff prepared low-tech lessons during restoration. WHIO and the WDTN report reproduce those measures. The school described possible restoration over several days, rather than a verified completion date.
On Oct. 1, the Palladium-Item report quoted the communications director saying systems remained limited for security reasons and Thursday’s parent-teacher conferences were canceled. This establishes disruption beyond the first announcement, without establishing closure of every school or continuous loss of every platform.
Confidence and uncertainty
The district’s Dec. 4 facilities statement describes continuing difficulty with maintenance repairs and monitoring after the attack. It expressly says the ability to provide climate control was unaffected. That staff burden is distinct from an assertion that ransomware stopped heating or caused all seasonal temperature problems described in the statement.
The reviewed notices establish cyber involvement, operational disruption and a reported information breach. They do not establish the volume copied, publication of stolen records, a payment outcome or a named operator. No named ransomware operator has been independently linked to the event.
Analytic gaps
Sept. 27 is the stated event date; Sept. 28 is the earliest directly reviewed public ransomware notice. The earliest reviewed external report explicitly cites that institutional post, supporting organization-first cyber characterization and organization-documented disruption. An earlier parent communication mentioned indirectly in later coverage needs direct verification before any disclosure backdating.
Dec. 4 is the latest reviewed dated statement of continuing operational difficulty. The precise recovery end remains unknown, so the incident remains presumed resolved. Detailed data categories and individual platform availability need stronger verification. This Indiana event is separate from the similarly named Michigan district’s older attack and PowerSchool’s later December 2024 vendor breach.
Organizations involved
Impacted locations
Richmond Community School Corporation, Indiana
The affected school corporation’s service territory includes parts of Richmond and surrounding Wayne County along the Ohio state line. This area identifies its physical remit; uniform disruption throughout the territory has not been established.
Richmond, Indiana
Richmond contains the affected school system’s administrative office and schools. The district documented a network shutdown, delayed opening, preschool cancellations and lessons without normal technology.
Sources
We reported Richmond Community Schools’ September 2024 ransomware incident, network shutdown and disruption of school routines. The district reported a breach of student and staff information in PowerSchool and announced a delayed opening and preschool cancellations.
Reports the district’s acknowledgment of ransomware and a breach of student and staff information in PowerSchool. It reproduces the network shutdown, expected restoration over several days, delayed opening, later bus runs and cancellation of morning half-day preschool.
The district said ransomware targeted its data-services network Sept. 27 and breached student and staff information held in PowerSchool. It shut the network, announced a two-hour delay and morning preschool cancellations for Sept. 30, and directed staff to prepare lessons without normal technology.
Reports a Sept. 27 ransomware attack on Richmond’s Indiana school district. The district said it shut its data-services network during the investigation and planned a two-hour delay, preschool cancellations and lessons using less technology while systems were restored.
The district’s communications director said systems remained limited for security reasons after the ransomware attack. The Oct. 1 report described cancellation of Thursday parent-teacher conferences, documenting disruption beyond the initial school-delay announcement.
The district’s Dec. 4 facilities statement said ransomware made maintenance repairs and monitoring more difficult. It said the ability to provide climate control had been unaffected and described ordinary responses to seasonal temperature complaints.
See something that needs correction?
Signed-in members can report an error, update, or missing source.