Oneonta School District Confirms Ransomware Attack; Cyber Incident Now Under Investigation

By JOSHUA YOUNGQUIST
ONEONTA

The Oneonta City School District has confirmed that the network disruption discovered late last week was the result of a ransomware attack, prompting two days of school closures and the launch of a third‑party cybersecurity investigation. Superintendent Thomas F. Brindley said the district is working with outside experts to determine the full scope of the breach and restore normal operations.

“What we initially believed to be internal technology issues has since been identified as a ransomware attack,” Brindley wrote in a districtwide message announcing Friday’s closure. 

In a follow‑up message to AllOtsego he added, “We have brought a wonderful third‑party cybersecurity firm to investigate cybersecurity incident. Aside from the information from my message to families yesterday that you are referencing, at this point I do not have anything to add other than we look forward to welcoming our staff in for a conference day on Monday and our students back on Tuesday.”

The attack, discovered Thursday, forced the district to shut down all buildings on Friday, October 23 and convert Monday, October 26 into a staff‑only conference day. Students are expected to return Tuesday, October 27. Athletic events and all‑day BOCES programs will continue as scheduled, while a.m. and p.m. BOCES students will not attend their sessions until Tuesday.

Brindley said the district’s technology team “acted immediately to implement measures designed to limit further unauthorized access and potential damage.” The district is following its established incident‑response protocols and coordinating with cybersecurity professionals and the appropriate authorities, he explained.

“At this time, we do not yet know the full extent of the incident or its potential impact on district operations,” Brindley wrote. “We understand that news of a ransomware attack may raise questions and concerns. As we learn more and are able to share additional information, we will continue to communicate openly with our families and staff.”

The district has not yet disclosed whether any student or staff data was compromised. Ransomware attacks often involve both system encryption and data theft, but officials say the investigation is still in its early stages.

The school district’s attack comes as the City of Oneonta itself faces heightened scrutiny over cybersecurity preparedness. Earlier this month, New York State Comptroller Tom P. DiNapoli’s office released a detailed audit of the city’s IT governance, concluding that officials “did not provide adequate governance to safeguard IT assets from cybersecurity threats.”

The audit found that while the city’s external IT vendor created policies and guidelines, the Common Council “did not formally adopt the policies and City officials did not review, enforce or monitor employee compliance.” It also noted that employees failed to complete cybersecurity awareness training within 30 days of hire and that officials did not document risk assessment activities.

The comptroller warned that without effective governance, the city faces “an increased risk of a successful cyberattack,” including “IT system downtime and disruption, the inability to provide services reliant on IT assets, data exfiltration or corruption by malicious actors, and increased remediation and recovery costs.”

Although the city and school district operate separate systems, the audit highlights broader vulnerabilities across local public institutions—vulnerabilities that cybercriminals have increasingly exploited statewide.

Ransomware attacks on school districts have surged nationwide, with K‑12 institutions becoming prime targets due to aging infrastructure, limited IT staffing, and the high value of student and employee data. New York has seen multiple districts forced offline in recent years, some for days or weeks.

Oneonta now joins that list, though Brindley emphasized the district’s commitment to minimizing disruption. Monday’s conference day will allow staff to “collaborate, develop plans and prepare for the anticipated return of students on Tuesday.”

“Our focus remains on protecting our district, supporting our students and staff, and returning to normal school operations as safely and efficiently as possible,” Brindley said.