Interlock ransomware group claims attack on Richmond Public Schools

What happened

According to the tracker RansomLook, the Interlock ransomware group claimed Richmond Public Schools on its leak site, in an entry dated 2026-11-09 RansomLook. A leak-site listing is the group’s own claim, not proof of an intrusion.

Only the headline of this story could be fetched. The full article could not be reviewed, so this advisory contains nothing beyond what the headline says.

Not confirmed:

• Whether Richmond Public Schools has acknowledged an incident. No source reviewed says it has.
• Which Richmond the headline refers to. The headline does not say.
• Whether any data was stolen or systems were encrypted, and how much data, if any, is involved.
• How an attacker would have gained access.
• Any independent verification of the claim. Only RansomLook, a claim tracker, carries it.

Am I affected?

Not confirmed. The sources do not say whether any data or systems of Richmond Public Schools were affected, or whether any individuals are affected. No CVE, software product or vulnerability is named in the source.

What to do now

1. Look for an official statement from Richmond Public Schools and treat that, not the leak-site listing, as the authority on what happened.
2. If you are an affiliated student, parent or employee, be cautious with unexpected emails, calls or messages that mention the school system, and verify them through official channels.
3. Check back here for updates. This advisory will be revised if the school system or another source provides confirmed details.

Sources

• RansomLook: Richmond Public Schools: claimed by the interlock ransomware group on its leak site