On October 17, 2026, ransomware attackers broke into Jerome School District’s network and took over security cameras, electronic door locks, and HVAC systems in eight schools. Schools were closed on Monday and Tuesday. The attackers threatened to leak student data if the district didn’t pay a ransom. The district did not say whether it paid. Schools reopened on Wednesday.
What the Hackers Actually Controlled
This attack was about more than just data. The attackers also targeted the physical systems inside the school buildings, not just the network.
Security cameras stopped working. The attackers also compromised electronic door locks that control access to the buildings. The HVAC system, which handles heating and air conditioning, was also affected.
This meant schools couldn’t monitor hallways, entrances, or common areas as safety rules require. Without working electronic locks, it was much harder to control who entered or left during an emergency. Without heating in Idaho in October, the buildings were difficult to use.
Superintendent Johnson was direct about why closing was the only reasonable call. “When you’re talking about cameras and door locks and our air-conditioning and heating systems and our internet, they are really core systems to make sure that our students are safe and our faculty can do world-class lessons every day.”
The compromised systems, including cameras, electronic locks, and HVAC, are all types of operational technology. These are internet-connected physical systems. Ransomware groups are targeting them more often because the disruption is immediate and obvious, which puts extra pressure on organizations to pay quickly.
The Data Threat
In addition to targeting physical systems, the attackers said they took student data and threatened to make it public unless the district paid a ransom.
Johnson told KMVT News that IT teams “worked around the clock to restore the network and to identify what information may have been compromised.” The district said it believes “most student data had not been compromised,” but acknowledged it hadn’t determined the exact scope of what was accessed.
The district did not specify which types of student records might be at risk. School districts usually keep names, addresses, grades, health information, and special education records, and each type has its own level of sensitivity.
Threatening to publish student data is a common double extortion tactic. Attackers first encrypt the systems and then threaten to leak the data. This puts extra pressure on victims because restoring from backups only solves the first problem, not the risk of data exposure.
The Flink triple extortion case, where attackers demanded separate ransoms from a company and its customers, shows that this approach is now common among ransomware groups. Schools are especially at risk because student data involves minors, which increases reputational pressure.
Did the District Pay?
Johnson would not confirm whether a ransom was paid or whether the district was planning to pay.
“I would rather these people be behind bars and be prosecuted for what they do, but it is delicate,” he told KMVT. He also acknowledged that “there are a lot of places that have paid” their attackers.
That last comment shows the reality many organizations face. Both public and private groups sometimes pay ransoms, especially when the disruption is serious and data exposure could harm vulnerable people. Schools with special education, medical, or child welfare records have legal duties to protect that data, which makes the decision even harder.
The district said it was working closely with law enforcement and cybersecurity experts.
Why Schools Are Under Attack
K-12 school districts are often targeted by ransomware because they have certain weaknesses. They store sensitive personal data about minors, usually have small cybersecurity budgets for their complex networks, and use many types of third-party software, which gives attackers more ways to get in.
In the past decade, schools have added many internet-connected systems. Security cameras, smart HVAC controls, electronic access, intercoms, and building management software are now online. If these systems aren’t secured, each one can be an entry point for attackers. The Jerome School District case shows how attackers can make a school’s physical campus unusable.
This pattern has also appeared in government attacks. For example, the Rhysida ransomware attack on Berlin’s government network disrupted ministries and public services across the city. While the scale is different, the method is the same: attackers get into networks connected to physical systems and use that disruption as leverage.
CISA’s K-12 cybersecurity guidance specifically identifies internet-connected building management systems as a concern for school districts.
The Ransom Dilemma for Public Schools
Public school districts face pressures that most private organizations do not. They rely on public funding, must follow transparency laws, and have to protect student records under FERPA, which sets rules for data breach notifications. Unlike companies, they cannot easily borrow money or get quick access to funds.
When attackers threaten to publish student data, especially for districts serving elementary-age children, the moral calculus shifts in ways that are genuinely hard to resolve. Johnson’s comment that he’d “rather these people be behind bars” isn’t just frustration. It acknowledges that the situation forces victims into choices that feel impossible.
The FBI’s advice is clear: paying a ransom does not guarantee you’ll get your data back; it doesn’t stop the data from being published, and it funds future attacks. Still, this advice doesn’t help a superintendent whose cameras and door locks are down.
For parents in Jerome and other districts, the main risk after attacks like this is targeted phishing and impersonation scams. Attackers with student records, such as names, addresses, and parent contact details, can use them to create convincing messages. Our guide on what to do if your data is on the dark web explains the steps parents should take after a school data breach.
Schools Reopened Wednesday
KMVT reports that Jerome School District schools reopened on Wednesday, October 22. The district has not yet shared a timeline for full system restoration or said exactly how much student data was accessed.
The investigation continues.
Frequently Asked Questions
What happened at Jerome School District?
Ransomware attackers breached the district’s network on October 17, 2026, taking control of security cameras, electronic door locks, and HVAC systems across eight schools in Jerome, Idaho.
How long were schools closed?
Schools were closed Monday and Tuesday, October 19-20, 2026. They reopened Wednesday, October 22.
Was student data stolen?
Attackers threatened to release stolen student data unless the district paid a ransom. The district said it believed “most student data had not been compromised,” but it did not confirm the full scope.
Did the district pay the ransom?
Superintendent Brent Johnson would not confirm whether the district paid a ransom or was considering it, calling the situation “delicate.”
How many students were affected?
The Jerome School District serves approximately 4,000 students across eight K-12 schools, including five elementary schools.
Why did hackers target school cameras and HVAC systems?
These internet-connected physical systems are part of modern school infrastructure. Compromising them creates immediate, visible disruption that pressures victims to pay quickly.
