Ransomware attack seizes school cameras, door locks, and HVAC — forcing two days of closures

Ransomware attackers infiltrated the Jerome School District in Idaho on October 17, 2026, gaining control of security cameras, electronic door locks, and HVAC systems across its eight K-12 schools. District officials shut all schools for two days before students were able to return.

Beyond the data theft — the attackers reportedly accessed student records and issued a ransom demand — the incident stands out because the breach crossed from the IT network into building systems. The cameras and door locks that were intended to keep students safe became tools the attackers controlled remotely. Officials have not confirmed whether a ransom was paid, describing the situation as "delicate."

This is a practical reminder that internet-connected physical security systems — cameras, electronic access control, and building automation — share risk with the rest of the network. Any organization that has these systems on the same network as general IT equipment may want to review whether those devices are isolated behind a firewall or on a dedicated segment. It is also worth confirming that default credentials have been changed, that firmware is current, and that your incident response plan addresses scenarios where physical security hardware itself could be locked out or taken over.