Jerome School District in Jerome, Idaho, was hit by ransomware in the pre-dawn hours of Saturday, October 17, 2026. The attack forced school closures for two days and took down cameras, door locks, phones, and other systems. Student devices were unaffected. Staff devices, approximately 500 of them, may have had data accessed. The district did not pay the ransom, which exceeded its cyber insurance coverage. CISA provided support. A forensic investigation is ongoing.
How the Attack Unfolded
Johnson described the attack in terms familiar to anyone who’s followed the evolution of ransomware: get in quietly, take what you can, then hit hard on the way out.
“If a group of criminals targeted a Walmart, they would get in as quickly as possible, grab what they want before tipping off security, then go full scorched earth on their way out to cover their trail.” That’s the analogy Johnson used, and it accurately describes the standard ransomware playbook.
The district’s security systems generated alerts when the attack started. Technology staff worked through the entire weekend trying to minimize the damage. The core response decision was to take the internet down entirely.
“You want to shut the internet down so things stop spreading and you can isolate, contain, and then move towards solutions,” Johnson said.
That decision had cascading consequences. Modern schools run more on networked systems than most people realize, not just computers and tablets, but door access systems, security cameras, environmental controls, and communications infrastructure. All of it went dark. The district canceled classes on Monday and Tuesday because of safety concerns, not because the technology was broken. The systems that control physical security in a school building were offline.
The Ransom Demand, and Why the District Refused
Johnson didn’t disclose the specific dollar amount the attackers demanded. He was equally clear about why the district didn’t pay.
“It was an amount that was not feasible for a school district of our size. I can say that the requested ransom far exceeded our coverage and would have required district funds.”
The Jerome School District carries cyber insurance, which is now standard practice for most districts, but the demand exceeded the policy’s coverage. The district would have had to use operational funds to close the gap, on top of whatever the insurance paid.
Following guidance from federal law enforcement and cybersecurity experts, the district broke off communications with the attackers and declined to pay. This is the FBI’s official recommendation, and it’s consistent with the response we’ve seen from other public institutions. As the Berlin government’s refusal to pay Rhysida’s ransom demonstrated, paying doesn’t guarantee data deletion or a clean recovery, and it funds the next attack against the next school, hospital, or city government.
Who Helped and What They Found
Within hours of detecting the attack, Jerome School District activated a multi-agency response.
School resource officers brought local law enforcement in immediately. The district alerted CISA, the Cybersecurity and Infrastructure Security Agency, which dispatched cybersecurity experts and mitigation specialists. A national cybersecurity nonprofit also assisted. Johnson declined to identify either the criminal group responsible or the full details of the district’s security posture, on advice from legal counsel.
“That was something I’ve been advised not to share because it’s like telling the enemy where you’re strong or weak,” he said.
The forensic investigation is focused on what the attackers actually accessed. Student devices were completely unaffected. The concern is the approximately 500 staff devices, phones, computers, and other equipment that staff use for administrative, communications, and instructional work. Those devices had to be individually evaluated before they could be brought back online.
For the 500 staff members in that window, the same principle applies to any exposure: monitor accounts associated with district email addresses, watch for phishing attempts that use district-specific details, and assume any data on those devices should be treated as potentially exposed until the forensic investigation concludes. Our guide on what to do when your data may have been exposed covers the practical steps.
The AI Arms Race That Makes This Harder Every Year
Johnson identified something important that most ransomware coverage of school districts misses entirely. The attackers are getting more efficient because of AI.
“Artificial intelligence has helped cyberattackers become more efficient,” he said. “And it’s a struggle for school districts to keep pace.”
He described the dynamic as a constant arms race. “If the professional hackers can’t beat the newest and greatest security stuff, they go out of business. That sounds really weird to say, but that’s the eventuality of it.”
This is accurate. The AI-enabled fraud and attack escalation that Google’s Threat Intelligence Group documented in September showed criminal groups using AI to automate reconnaissance, identify vulnerabilities, and deploy attacks at scale. For a school district with a fraction of an enterprise company’s security budget and far more networked systems to protect, that asymmetry is genuinely difficult to manage.
Jerome School District employs hundreds of staff and manages systems from door locks to learning management platforms. Each connected system is a potential attack surface. A professional criminal group using AI to probe for the weakest entry point across a dozen networked systems simultaneously has a meaningful structural advantage over a district IT team trying to keep all of those systems updated and monitored.
Back to “Old-School School”, And Then Recovery
School resumed on Wednesday, October 22, five days after the attack. Teachers had no technology for the first few days.
“We had a couple of days of old-school school, which some people really liked,” Johnson said.
The district reissued the last staff devices by the time Johnson spoke with Idaho Education News on October 30. Classes were more or less back to normal. The forensic investigation continues.
In the weeks since the attack, Johnson said local businesses contacted the district to share that they too had been cyberattack victims. Other school districts reached out asking how Jerome had handled the situation.
“There’s been a lot of positivity, and it’s also really discouraging that this is the reality of our world right now too,” he said.
Johnson also connected the school attack to a broader pattern he has seen personally. His grandmother received a phone call from a scammer pretending to be him, claiming he had been in a car crash. She called him to verify. He also described routine phishing attempts in which scammers impersonate him via email to district staff.
“It’s crazy, but people pretend to be me and email the employees,” he said. “We have phishing protections, and we have training to try to help folks out, but we get a lot of email, and we have a lot of employees, so it’s difficult.”
The pattern here connects to the broader social engineering threat that shows up across institutions: phishing, impersonation, and credential theft are all feeding the same criminal pipeline. A ransomware attack on a school district is usually the end of a chain that started with a phishing email or a compromised credential weeks before.
What Schools Can Do, and What CISA Offers
CISA maintains a dedicated resource page specifically for K-12 schools and offers free cybersecurity assessments, incident response support, and risk and vulnerability assessments to public schools. The K-12 Security Information Exchange (K12 SIX) also maintains a database of school district cyber incidents and guidance on prevention.
If a school district suspects it is under attack or has experienced a breach, the recommended sequence is the same as Jerome’s: notify local law enforcement, alert CISA, and contact the FBI’s Internet Crime Complaint Center at ic3.gov. Do not pay a ransom before consulting federal law enforcement.
Frequently Asked Questions
When was Jerome School District attacked?
In the pre-dawn hours of Saturday, October 17, 2026.
Were students’ data or devices compromised?
Student devices were completely unaffected. Some staff devices among the district’s approximately 500 may have had data accessed. The forensic investigation is ongoing.
Did Jerome School District pay the ransom?
No. The district refused to pay, following guidance from federal law enforcement and cybersecurity experts. The ransom demand exceeded the district’s cyber insurance coverage.
How long were schools closed?
Schools were closed Monday, October 20, and Tuesday, October 21. Classes resumed on Wednesday, October 22.
What systems were taken offline?
Cameras, door locks, heating and cooling systems, phone systems, and communications infrastructure were all shut down as part of the containment response.
Who helped the district respond?
Local law enforcement, CISA (which provided cybersecurity and mitigation experts), and a national cybersecurity nonprofit all assisted.
