Richmond Public Schools hit by cybersecurity incident; students told to stay off school networks

RICHMOND, Va. — Richmond Public Schools students and staff were warned Wednesday morning not to connect any personal devices to school networks after district leaders detected suspicious activity on the RPS network.

The warning came via email at 8 a.m. Hours later, RPS Superintendent Jason Kamras confirmed the suspicious activity was a "cybersecurity incident" that is "disrupting several operational systems."

As a precaution, Kamras said internet access was taken offline across the district. That decision limits phone and email service, as well as access to online classroom tools and learning platforms.

Kamras said the safety of students and staff is not affected and that in-person school would proceed as scheduled, with teachers adjusting lessons and activities as needed.

However, at least one RPS teacher told CBS 6 that adjusting without internet access would be extremely difficult.

"How am I supposed to adjust lessons and activities without textbooks or access to copiers or internet?" the teacher said. "All my materials are in my Google drive."

What cybersecurity experts say

Alex Nette, a cybersecurity expert, said the steps RPS took are consistent with standard protocol when a network threat is detected.

"Something has obviously happened," Nette said. "This is one of the initial steps that any organization or school system will take when something is going wrong."

Nette also warned that connecting additional devices to a compromised network can make the situation worse.

"Avoid adding and connecting to any devices or systems that they may use regularly, because that means that infection could spread," Nette said.

Is this a ransomware attack?

CBS 6 asked RPS whether any district data had been encrypted and whether this was a ransomware situation. District officials said they could not confirm specifics at this time, saying only that they are "working with cybersecurity experts to determine the scope of the situation."

Ransomware is a type of cyberattack in which hackers encrypt a victim's data and demand payment to restore access. School districts have become increasingly common targets.

What happens next

Kamras said the district is working with both cybersecurity experts and law enforcement to understand what happened. He said the district will share updates as more information becomes available.

This is a developing story, so check back with WTVR.com for updates. Email the CBS 6 Newsroom if you have info, photos or videos to share.