A September 2025 ransomware incident disrupted Uvalde CISD’s phones, network and safety systems, forcing campus closures. The district later reported restoration from backups without a ransom payment; Qilin subsequently claimed data theft that the district had not verified.
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
The organization lost or materially restricted internet connectivity.
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
Internal business, administrative, operational, or staff-facing systems were unavailable.
Instruction, student services, school administration, learning platforms, transportation, or other educational operations were materially affected.
One or more offices, schools, clinics, stores, plants, branches, or other facilities closed because of the incident.
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
The disruption created or increased a risk to physical safety, public safety, patient safety, industrial safety, or safe operations.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
An authoritative source stated that no ransom or extortion payment was made.
Uvalde Consolidated Independent School District in Texas experienced a confirmed ransomware incident that interrupted operational and safety systems and forced campus closures in September 2025. We reported the initial closure announcement Sept. 13, after the district identified ransomware on its servers.
The district’s initial account described effects on phones, thermostat controls, camera monitoring and visitor management. Later reporting documented a return to classes followed by additional network recovery; a reopening date alone does not capture the entire disruption.
The district initially announced closures for Sept. 15–18 while investigating and recovering essential systems. By the week of Sept. 22, students had returned, but the district’s spokesperson said external internet access was not restored until Sept. 23 and some teachers had adapted lesson plans.
The same follow-up reporting distinguished later air-conditioning problems from the ransomware recovery. It described mechanical or longstanding faults at the high school and a drain-pan issue at Dalton Elementary. Those problems should not automatically extend the cyber incident’s operational timeline.
Confidence is high in ransomware involvement and material disruption because the affected district confirmed both and described the restoration process. Its Sept. 26 update, as reported by KSAT, said systems were restored from backups, the access point was resolved and no ransom was paid. Those are recovery findings, while the investigation into sensitive-data access remained open.
Comparitech’s report updated Oct. 10 described Qilin claiming responsibility and alleging employee, student and financial information, including purported sample images. Confidence in attributing the intrusion to Qilin is low because the reviewed link is the group’s claim; the alleged files and theft were not independently authenticated.
The exact technical entry method, complete affected-system inventory, final data-acquisition findings and full recovery cost remain unestablished. The district’s statement that it had found no evidence of sensitive-data access is a qualified finding; the later claim does not by itself overturn it. The district’s reported denial of payment is more specific than a later report’s general statement that payment was unknown.
The last specific continuing-impact observation located is Sept. 23, 2025, when external internet access was restored after classroom workarounds. The district’s reported Sept. 26 statement that systems had been restored from backups supports resolved status by that date. Sept. 26 is the documented recovery milestone, rather than a precisely observed end time for every affected function.
Qilin listed the district and alleged employee/student/financial files. Matching ransomware.live lead discoveredOct.9,2025 at22:46:30.287507Z; Comparitech report updatedOct.10 describes the claim and purported sample images. Primary claim posting timestamp and file authenticity were not independently verified. This relationship records an allegation, not proven exfiltration or actor attribution.
Districtwide campus closures and essential-system interruption justify the verified school service area. County/municipal government outages are not implied.
Retains the Uvalde municipality as the site anchor for district headquarters and affected campuses. The larger verified district service polygon is separately represented; city government is not a victim.
We reported district-confirmed ransomware, planned campus closures and disruption to operational and safety systems.
District officials confirmed ransomware on servers and loss of essential phones, control and safety systems.
The district said systems were restored from backups and no ransom was paid; internet restoration continued after classrooms reopened.
The report describes Qilin claiming the district and alleging employee, student and financial files; the district had not verified the claim.
Signed-in members can report an error, update, or missing source.
