The Door Locks Edition

Four districts and two vendors lost control of something this week. One of them lost the doors.

In Jerome, Idaho, the people who broke into the school district's network did not stop at the files. They took the cameras, the electronic door locks and the heating system, and the district closed every school for two days because it could not guarantee the building. In Richmond, teachers walked in Wednesday morning to ransom notes on their own laptops, and the district cut the internet to all fifty-three campuses. Oneonta, New York, closed Friday, then closed again Monday. Meanwhile two vendors most families have never heard of disclosed that they had lost records on millions of children: a testing contractor in California, and the company that runs the anonymous tip line your students are told to use when they are frightened. Five incidents, seven days. If you have been waiting for the week that makes the case for your district's security budget, this was it.

Infrastructure | Idaho

Attackers took a district's cameras, door locks and heat, and the schools closed

Teachers in the Jerome School District started reporting network trouble on October 17. What they had was ransomware, and it had reached well past the file server. The attackers had control of the district's cameras, its electronic door locks and its heating and cooling. Jerome closed all of its schools Monday and Tuesday and reopened Wednesday. The district serves about four thousand students across eight schools. Officials say the attackers accessed student data and demanded a ransom, the superintendent believes most student data was not taken, and the district will not say whether a ransom was paid, calling the question delicate.

Why it matters: Read the list of what they took again, because it is the part that should change a conversation in your district. Not grades. Not email. The locks. A school can run a day without email and cannot run a minute without knowing the doors do what the office tells them to do, and that is why Jerome closed. Somewhere in your district there is a list of things that live on the network, and it almost certainly includes badge readers, cameras, bells, HVAC and the phones. Ask for that list. Then ask the only question that matters: if the network is hostile tomorrow morning, can we still lock a door, count children and call a parent. If the answer requires the network, you do not have a technology problem, you have a building problem. And notice the part nobody wants to say out loud: the district will not discuss the ransom. That is not evasiveness, it is what every lawyer advises. Decide now, while nothing is wrong, who in your organization is allowed to answer that question, because the morning it happens is a terrible time to find out.

Source: KMVT, Twin Falls, October 20, 2026

Incident | Virginia

Richmond teachers found ransom notes on their own laptops, and the district cut the internet

Richmond Public Schools, about twenty two thousand students across fifty three campuses, learned it had a problem on Wednesday October 22, when employees found threatening messages on district-issued laptops demanding contact within seventy two hours. The district shut off internet access across every campus. Phones, email and online learning tools went down. School stayed open and teachers adjusted lessons on the spot. Days later the district still could not confirm whether data had actually been taken, whether files were encrypted, or whether the incident even met the definition of ransomware.

Why it matters: The detail worth stealing from Richmond is that school stayed open. Fifty three campuses lost phones, email and every online tool on a Wednesday morning, and teachers taught anyway. That only happens when people already know what to do, and it is the cheapest preparation in this entire edition. You do not need a budget line to keep one unit you could teach tomorrow with no login, to know where the physical copies are, and to know how the office reaches you if the phones are dead. The second lesson is about language. Richmond would not call it ransomware for days, and they were right not to, because the honest answer early on is that nobody knows yet. When this happens near you, expect your district to say less than you want. That is usually counsel talking, not a cover-up. What you are entitled to ask is narrower and fairer: tell us what you do know, tell us when you will next tell us something, and tell us what we should do in the meantime.

Source: Hoodline, October 22, 2026

Incident | New York

Oneonta thought it was a glitch. It closed school twice.

Administrators in the Oneonta City School District first believed they were dealing with an internal technology problem. It was ransomware. The district closed to students on Friday October 23 and closed again on Monday October 26, and brought in an outside cybersecurity firm to work out whether student records or personal information were exposed.

Why it matters: This is the most ordinary story in the edition, which is exactly why it belongs here. No stolen door locks, no dramatic ransom note on the screen. Just a district that thought something was broken and discovered something was wrong, and lost two instructional days finding out. The gap between "the system is acting up" and "we are under attack" is where small districts lose time, because the first call goes to the person who fixes printers rather than the person who makes decisions. Ask who in your district is empowered to escalate a technology problem into an incident, and how fast. If that authority sits with one overloaded technology director, the answer is slower than you think. And for families: closing twice is not disorganization, it is a district declining to reopen a system it cannot yet trust. That is the right call, and it costs them to make it.

Source: WBNG, Binghamton, October 23, 2026

Data Security | National

They took the anonymous tip line, and Nevada says it waited seven months to say so

On October 23, Navigate360 disclosed that attackers copied about 8.3 million records from its anonymous tip platform, one day after Nevada's Department of Education warned families that its SafeVoice line was affected. The stolen tips may include student and family names, addresses, phone numbers, email addresses, dates of birth, student ID numbers, Social Security numbers and medical information. Navigate360's platforms are used by roughly thirty thousand schools, law enforcement agencies and Crime Stoppers chapters, and the programs built on it include Safe2Tell, Safe2SayPA and reporting lines run with Sandy Hook Promise. Nevada has accused the company of waiting nearly seven months to disclose the scope.

Why it matters: Of everything in this edition, this is the one that can cost a child something. We teach students that the tip line is safe and anonymous, and for a lot of them it is the only way they will ever report a weapon, a threat, or what is happening at home. The promise we made them was confidentiality, and the records of what they said are now in someone else's hands. Two things follow. First, find out this week whether your state or district uses a Navigate360 product, because the brand on the poster in your hallway is probably not the word Navigate360. Second, think hard before you say anything to students, and say nothing you cannot stand behind, because the fastest way to kill a tip line is for children to decide it leaks. For leadership, the seven months is the real finding. Every vendor contract you sign should name the number of hours you get before you are told, and this is the week to go look at what yours actually says.

Source: International Business Times, October 23, 2026

Data Security | California

One stolen login, four months inside, about seven million California students

The testing vendor ETS has disclosed that an unauthorized party used a single compromised login to reach a file transfer site and copy records on roughly seven million California public school students between May 22 and September 18. ETS identified the intrusion on September 25, the California Department of Education alerted districts on October 2, and families began receiving notices on October 16. The exposed data includes names, addresses, dates of birth, student identification numbers, demographic information, assessment data and disability information. ETS says Social Security numbers, financial information, passwords and parent information were not taken.

Why it matters: Note what was not taken and then notice what was, because the comfort here is thinner than it sounds. No Social Security numbers is genuinely good news. Disability information is not. A list of which children have which disabilities, tied to names, addresses and birthdates, is some of the most sensitive material a school system holds, and it is now loose. If you teach in California, assume the families of your students with IEPs will hear about this, and that some of them will ask you what it means. You are allowed to say you do not know and to point them to the district. For everyone else, the mechanism is the lesson: one credential, four months, nobody noticed. Ask your vendors two questions that have nothing to do with marketing. Is multifactor authentication required on every account that can reach our student data, with no exceptions for service accounts. And would you detect a login copying files for four months. Four months is not a sophisticated attack. It is an unwatched door.

Source: Education Week, October 2026. Parent guidance: LAist, what to do

Policy | New York City

The banned list finally came out, and some of the companies on it say they do not belong there

After more than a month of requests, Chalkbeat obtained the list of products New York City flagged under its new restrictions on student-facing AI, the policy Mayor Mamdani announced days before the school year began, which promised to discontinue or disable the AI components of more than thirty eight previously allowed programs. The list includes widely used reading and math curriculums, student assessment tools, and a chatbot the Education Department itself built. Several companies said their products do not use the kind of AI the policy prohibits and that they do not know why they were flagged.

Why it matters: This is what happens when a policy defines the thing it is banning loosely, and it is coming to a district near you. The phrase "AI component" covers a chatbot that talks to a child and also covers an adaptive reading program that picks the next passage, and those are not the same product or the same risk. New York now owns the job of sorting them, in public, with vendors objecting. The transferable lesson for your own district is to write the definition before you write the rule. Ban the behavior, not the buzzword: a tool that generates open-ended text for a student, a tool that holds a conversation, a tool that makes a consequential decision about a child without a human reading it. Those you can actually identify. And if you are the person who has to assemble your district's inventory, start with the honest version of the question, which is not "what did we buy" but "what is actually being used," including the free thing a teacher signed up for alone in September.

Source: Chalkbeat New York, October 23, 2026

Evidence | National

Districts are running AI experiments they have no way to grade

NPR's Lee Gaines reported on October 19 that schools trying AI keep hitting the same wall: there is no good way to tell whether it is helping. At the Alternative School at Jackson Center in Dayton, students talk to a chatbot named Jordan that asks them for advice about its feelings, on the theory that students will open up about their own. Staff believe it is doing something. They have no way to quantify what. The best the district can do is ask the students and the adults how it is going. Wichita is introducing tools slowly and ran an AI exploration day for middle schoolers.

Why it matters: The Dayton chatbot is a genuinely clever idea, and the district deserves credit for saying plainly that it cannot prove it works. Hold both of those thoughts, because this is the honest state of the field. Nobody is going to hand you a clean effect size this year. What you can do is stop running pilots without a question attached. Before the next tool arrives, write down one sentence: what will be different, for whom, by when, and what result would make us stop. "Teachers like it" is a real finding about adoption and is not a finding about learning. Ask students, the way Dayton does, and write the answers down somewhere other than a hallway conversation, because in two years when someone asks whether the money was worth it, the district with sixty student interviews in a folder is going to be in a much better position than the district with a renewal invoice.

Source: NPR, October 19, 2026

Research Funding | Federal

A new report asks Washington to pay for the evidence nobody has

A report covered by Education Week this month calls on Congress and the administration to build a stronger evidence base for safe and effective AI in education, and to fund the research that would produce it. It lands in the same week districts told NPR they cannot measure what their own AI tools are doing.

Why it matters: Put this next to the NPR story and you have the shape of the problem. Districts cannot generate this evidence on their own, because a single district does not have a control group, a research design or anyone whose job it is to run one, and the vendors are not going to fund studies that might find nothing. That is precisely the gap public research money exists to fill. Whether it arrives is a policy question above your pay grade and mine. What is in your control is refusing to wait for it before asking a vendor a direct question: show me results from a district that looks like mine, and tell me whether you measured learning or measured logins. The answer you get, and how quickly, tells you most of what you need to know about who you are buying from.

Source: Education Week, October 2026

Literacy | Texas

What AI is doing to reading, asked out loud on public radio

Houston Matters devoted a segment on October 20 to what AI use may be doing to reading and the future of literacy, on the same program where Houston ISD's decision to share its taxpayer-funded curriculum materials with other districts at no cost was discussed.

Why it matters: The reading question is the one I get from parents more than any other, and it deserves a better answer than a shrug. Here is the honest version. We do not yet know what sustained AI use does to a developing reader, and we do know what it does to a reluctant one, which is to remove the exact friction where comprehension is built. A child who asks for a summary skips the part where they had to hold two paragraphs in their head at once. That is not cheating, it is efficiency, and efficiency is the enemy of building a reader. You do not need a policy for this. You need to be explicit with students about which tasks are supposed to be hard on purpose, and to name it in the moment: this one you do without help, because the struggle is the lesson. Say the quiet part out loud and most children will go along with it.

Source: Houston Public Media, Houston Matters, October 20, 2026

Opportunity | Tennessee

Tennessee opened a statewide AI challenge, and it is free to enter

The AI Tennessee Challenge kicked off on October 19. Students are asked to find a real problem in their own community and work out how AI could help solve it, across public safety, health, education, the environment and civic life. It is co-led by AI Tennessee and the ADEPT Center at the University of Tennessee, Knoxville, with East Tennessee State, Fisk, Middle Tennessee State, Tennessee Tech, the University of Memphis, Vanderbilt, SCORE, the Tennessee STEM Innovation Network and the state education department. Earlier Tennessee teams have built a homework helper, tools to reduce litter, tools to support elder care, and a way to spot resource gaps during natural disasters.

Why it matters: After four breaches and two closed districts, end on this one. The framing is the thing worth copying even if you are nowhere near Tennessee, because it inverts the assignment every student has already been given a hundred times. Not "use AI to do your work faster." Find something wrong where you live and ask whether this tool is any use against it. That question produces exactly the habits we claim to want: define a problem, work out whether the technology actually fits, and be willing to conclude that it does not. You can run that as a two-week unit with no competition, no budget and no new software. If you are in Tennessee, the entry is free and the deadline information is on the site.

Source: AI Tennessee

Five security incidents in seven days is not a run of bad luck, it is what the year looks like now. If you only do one thing with this edition, ask your district the Jerome question: what in this building depends on the network, and what happens the morning the network is not ours.

See you next Saturday.

Dr. Janette Camacho, EdD

Founder and CEO, iTeachAI Academy