Could Your School Keep Running If the Network Went Dark Tomorrow?

Nov 6

Picture finding a ransom note on every staff laptop tomorrow morning. Email is down, Wi-Fi is off, and nobody can open the student information system. The first bell still rings on time.

Staff at Richmond Public Schools in Virginia walked into exactly that on October 21. Whether you run a district or a campus, what would your people do first?

A Hard Fall for Schools and Colleges

Richmond cut internet access across the division, which also took out email, online classroom tools and front-office phones. Schools stayed open and teachers went to paper. By October 29 the district had set up a separate network for Chromebooks and was working with the FBI and Virginia State Police.

A day later, Oneonta City School District in New York found that what looked like ordinary tech trouble was ransomware. It closed to students on October 23 and 26. The superintendent said staff had trained for this kind of incident and were working from a checklist.

On October 31, the Rhysida ransomware group claimed it had stolen 445 GB from Phoenix Charter Academy in Massachusetts, including special-education plans, immigration records and staff W-2s. That comes from the group's own posting, and we haven't seen the school confirm it.

Arkansas has had its share too:

UCA's Community Care Clinic in Conway confirmed that an unauthorized party had access to one of its IT systems from September 4 to September 28, and that a file of patient email addresses was accessed or taken. The clinic warned that people may get phishing emails because of it.
A ransomware group says it took more than 500 GB of student, staff and financial data from Philander Smith University in Little Rock. The university has not publicly confirmed a breach.
Comparitech counted ransomware attacks on colleges and universities worldwide rising 88% from the second quarter of 2026 to the third, from 24 to 45. Most of the education attacks it tracked that quarter were claims the victims hadn't confirmed.
Arkansas Legislative Audit's latest annual report lists 94 cybersecurity incidents reported by school districts in fiscal 2025. Spam or phishing led with 40, then fraudulent transactions (23) and business email compromise (13). Two were ransomware.

None of these organizations has said publicly how the attackers got in, so we won't guess.

Plan for a Day With No Network

Most incident response plans sit on a file server, which is one of the first things you lose. What you need is a plan for running school or campus without your systems for a day, a week or longer.

CISA's #StopRansomware Guide says to keep a hard copy of your incident response plan along with an offline version. The FBI's Internet Crime Complaint Center (IC3) tells organizations to create a continuity plan in case they're hit. For a school or college, that covers a few practical things:

Emergency contacts, medical information, approved pickup lists and bus rosters, printed and refreshed every term. Richmond released children only to adults already approved in PowerSchool. Could you pull that list with PowerSchool down?
Lessons teachers can run on paper tomorrow, and a way to print them if your copiers sit on the network.
A fallback set of devices. Richmond used Chromebooks on a separate network, so decide now which devices you'd hand out and how.
A manual process for payroll and payments if the business office loses its systems near payday.
One way to reach parents, students and staff that doesn't run through your own email. CISA also recommends out-of-band contact, like phone calls, while you respond, so the attackers don't see what you're doing.

Make the Hard Calls Before You Need Them

Put these on paper now, before you need them:

Your cyber insurer's claim line. Your policy may name the response firms you're required to use, so read it before anything happens.
CISA, your local FBI field office or IC3. CISA's guide says to report to them and consider asking for help. The FBI does not support paying a ransom and says payment doesn't guarantee you'll get your data back.
Your attorney. Breach notification rules come from state law, and CISA's guide says to consult legal counsel when needed.
Arkansas Legislative Audit. Under Ark. Code Ann. § 10-4-429, Arkansas public entities, school districts included, must send the Legislative Auditor an initial written report within five business days of learning of a security incident. In fiscal 2025, 40 of the 217 reports from all public entities came in late, and some entities said they hadn't known about the requirement.
The names of the people who decide. Who can take the network offline? Who speaks to parents and the press? Who, if anyone, talks to the attackers?

Backups and Admin Accounts Decide How Fast You Recover

A ransom note has leverage only if you can't recover without paying.

CISA recommends offline, encrypted backups that you test regularly, because many ransomware strains look for backups they can reach and delete or encrypt them. Keep at least one copy of your student information system, finance and HR data offline or immutable, protected by credentials that aren't in your main directory. Then do a full restore from it, so you know it works. (We covered this in more depth in our post on backup strategy.)

CISA's guide also says to separate administrator accounts from user accounts. The login your IT director uses for email shouldn't be the one that can change the whole domain.

Turn on MFA for every staff account. For admins, go further. CISA urges phishing-resistant MFA, especially for email, VPNs and accounts that reach critical systems, and calls it the gold standard. In practice that usually means FIDO security keys, and your admins are the place to start.

Expect Phishing After the Breach Notice

When a breach makes the news, the scam emails usually get worse. UCA's clinic warned that people who received its notice could be targeted by phishing because of the incident, and it encouraged them to change their email passwords.

Criminals know people expect follow-up emails after a notice, so they send fake credit monitoring sign-ups, fake "verify your account" messages and fake invoices that mention the incident. If you have to send a notice, tell people exactly how you'll contact them and what you will never ask for. If a school or college near you is in the news, warn your own staff, since they may see the same lures.

Would Your Organization Catch It?

If the network went down at 7 a.m. on a school day, could someone find a printed plan?
Could you release students to the right adults without your student information system?
Is your insurer's claim number and your FBI field office contact written down somewhere off the network?
When did you last restore your SIS or finance system from backup, start to finish?
Do your admins use separate accounts with phishing-resistant MFA?
Would your report reach Arkansas Legislative Audit within five business days?

If one of those was hard to answer, start there.

How Red Garrison Can Help

We look at your network the way an attacker would, then work alongside your team on what matters most.

Our K-12 and higher-ed security program pairs year-long, quarterly penetration testing with 24/7 Huntress-powered monitoring and response, built for Arkansas schools and campuses.
Incident Assist helps when something already looks wrong. You start with a defined assessment and know the price before work begins.
Cyber insurance readiness checks the controls carriers ask about, like MFA on admin accounts and tested offline backups, so your answers on the questionnaire hold up.
For public districts, Act 504 of 2023 (Ark. Code Ann. § 25-1-128) covers the policy side. Our Act 504 support includes building an incident response plan that works when the network doesn't.
The Red Garrison Bootcamp trains non-technical staff to spot phishing, including the kind that follows a breach notice.

Let's Build Your No-Network Plan Together

Schedule a free assessment before winter break. We'll sit down with your team and look at whether you could run school for a day with no network, whether your backups would survive an attacker and whether your call list is ready. You'll leave with a short, prioritized list of fixes.

If you're already worried something is wrong, Incident Assist assessments start at $199 for individuals and $750 for organizations. Or call us at (501) 404-5966.

We think like attackers. We work like partners.