Interlock Ransomware Lists Richmond Public Schools and Three More Districts in One Day, Claiming Medical and Special-Needs Records

A ransomware crew has put one of Virginia’s largest urban school systems on its dark-web leak site, and it did not stop there. On November 10, the Interlock group listed Richmond Public Schools and, the same day, three more U.S. districts, turning a three-week-old network outage into a full-blown data extortion case involving some of the most sensitive records a public institution can hold: student medical, mental-health and special-education files.

The episode is a sharp reminder that ransomware gangs increasingly treat K-12 districts like any other mid-sized enterprise: big enough to hold valuable data, but rarely staffed or funded to defend it.

What Happened in Richmond

According to CBS 6 (WTVR), suspicious activity was detected on the Richmond Public Schools (RPS) network on Wednesday, October 21, and the district took its systems offline as a precaution. In an announcement late Monday, November 9, officials said data accessed in the incident may now be on the dark web, that they are working with law enforcement, and that free credit monitoring is being offered to staff, students and families. The district stressed that a posting does not mean any individual’s information was definitely affected.

The next day, the group posted RPS on its leak site. As summarized by the education news show Net Gain Edtech, the listing claims disciplinary, medical, speech-therapy, mental-health and special-needs education records, along with other personal information, tied to the district’s roughly 22,000 students. Threat-intelligence trackers including DeXpose attribute the listing to Interlock. As with any leak-site post, these are the criminals’ claims; the district has not confirmed what, if anything, was taken.

Three Weeks Later, Still Rebuilding

At a school board meeting reported by 12 On Your Side (WWBT) on November 11, district leaders said a forensic audit is underway and that the attack is still affecting daily operations. It had taken the entire division offline, knocking out online classroom tools, phones and email.

Chief Operating Officer Patrick Herrel described the scale of the recovery: more than 50 sites, more than 22,000 students and more than 4,000 teachers and staff. The technology team has stood up a temporary network, issued Chromebooks that run on a separate, uncompromised server, and is building a permanent network from recovery backup data. A division-wide password reset is also in progress. Board members said they would consider asking state legislators to create a cyber-preparedness grant program for schools.

One Gang, Four Districts, One Day

Richmond was not alone. On the same day, the group also claimed Jerome School District and Meadows Valley School District in Idaho and Indiana Area School District in Pennsylvania, per Net Gain Edtech. Tracker feeds for November 10 also show Interlock naming a Virginia high school, an auto dealership, a dental group and a children’s services center. Net Gain’s advice to technology directors: treat a cluster of same-day claims as a sign the group is working through a backlog of districts it has already compromised.

Interlock is not a new name. U.S. authorities, including CISA and the FBI, issued a #StopRansomware advisory on Interlock in 2025, warning that it uses double extortion: steal data first, then encrypt systems, and threaten to publish what it took.

The Bigger Picture: Data Theft Is the Weapon

The Richmond case fits squarely into the trends incident responders have been reporting all year. In its Q3 2026 report, Coveware by Veeam found data exfiltration in 71% of the cases it handled, with operational impact such as encryption or outages rising to 50% of cases. The median ransom payment climbed 167% from the prior quarter to $400,000, even as the average fell 45% to about $1.03 million. Phishing and social engineering were the leading way in, at roughly 29% of cases, followed by remote-access compromise (22-23%) and stolen credentials (14-15%).

Coveware also found the median victim had 1,121 employees, up 49% from the prior quarter, as attackers move toward mid-market targets. A district with more than 4,000 staff and 50-plus sites fits that profile well. GuidePoint Security’s GRIT Q3 2026 report, which spotlighted the education sector, counted 7,174 publicly posted ransomware victims from 155 threat actors in the first three quarters of 2026, up from 5,228 victims and 110 actors in the same period of 2025.

Why It Matters to Business Leaders

Sensitive data raises the stakes far beyond downtime. Medical, mental-health and special-education files cannot be “reset” the way passwords can. Once that kind of information is posted, the harm to the people involved, and the legal and reputational exposure for the organization, can last for years. Any business holding health, HR or customer financial data faces the same calculation.

Backups saved the operation, not the data. RPS is rebuilding from recovery backups, which is exactly what resilience planning is for. But as Coveware notes, data that has already left the network cannot be recovered. That is why more victims now treat theft-only extortion as a legal, governance and communications crisis rather than a purely technical one, and why most still decline to pay for an unverifiable promise to delete stolen files.

Recovery is measured in weeks. Three weeks after detection, Richmond is still running on a temporary network. For a company, that would mean weeks of degraded sales, support and billing. Leaders should ask whether their incident plans assume a few days of disruption when reality is closer to a month.

Your vendors and partners are part of your attack surface. School districts, hospitals and local governments sit inside dense networks of contractors and service providers. Interlock’s same-day listings across very different organizations show how widely one crew can cast its net. Supplier security reviews, least-privilege access and strong multi-factor authentication on remote access are basic, but they directly target the entry points Coveware says attackers favor.

The Bottom Line

The Richmond Public Schools case is still unfolding: the forensic audit is not finished, and the district has not confirmed what data was exposed. But the pattern is already clear. Ransomware groups are betting that the threat of leaking deeply personal records is more powerful than locking up computers, and they are aiming that threat at mid-sized organizations that hold sensitive data with limited security budgets. Whether you run a school system or a business, the lesson is the same: plan for the data leaving, not just for the systems going dark.

Edited by Coron @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous