Richmond Public Schools has warned that data taken in its October cyberattack may have appeared on the dark web, nearly three weeks after the incident forced the Virginia district offline. Superintendent Jason Kamras gave the update on Monday, 9 November, saying the district had learned that day that information improperly accessed during the attack may have been posted online.

What the district has confirmed

The district has not said which systems the attackers reached, has not named the group behind the attack, and has not said how much data was taken. Kamras said Richmond is working with law enforcement to verify the claim and find out exactly what information was disclosed, alongside outside cybersecurity experts and state and federal investigators. The FBI and Virginia State Police joined the investigation in the weeks after the attack.

Interlock claims the district

The ransomware group Interlock listed Richmond Public Schools on its leak site on 9 November, claiming to have taken about 1,550 GB of data, a claim that has not been independently verified. The group's statement says it is releasing disciplinary, medical and special-needs records alongside personal details including names, birth dates, addresses and Social Security numbers. The attack began on 21 October, when ransom notes appeared on staff laptops and the district took its internet offline, disrupting phones, email and classroom systems across 53 campuses serving about 22,000 students. The district is offering free identity and credit monitoring to students and staff while the investigation continues. PrivacySavvy reported the warning on 10 November, and DeXpose recorded the Interlock listing the same day.