Cyber Incident Victim: Alamo Heights Independent School District
Date:
Mar 2026
Location:
United States of America
Summary
Alamo Heights Independent School District experienced a cyber attack that disrupted internet access for nearly a week and exposed personal information, including Social Security and financial data, of roughly 26,000 individuals. Following the incident, the district notified affected parties, worked with forensic investigators to restore systems, and reported that its cyber insurance covered more than $36,000 in recovery costs while declining to disclose whether a ransom was paid.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In late March 2026, Alamo Heights Independent School District experienced a cyber attack that disrupted Internet access for staff and students for nearly a week. Officials first noticed connectivity problems on March 23 and announced on March 27 that the issue had been resolved and district technology systems restored with the assistance of external forensic investigators. The restoration meant the external threat no longer had access to the district's network. During the weeklong outage, the district worked to restore its systems while beginning an investigation into the breach. The attack exposed personal information, including Social Security numbers and financial data, of approximately 26,000 individuals.
Following the forensic investigation, the district confirmed that personal information had been accessed and potentially downloaded as a result of the incident. In accordance with Texas breach notification requirements, Alamo Heights ISD notified affected individuals by U.S. mail. The district also reported the attack to the Federal Bureau of Investigation. Texas law mandates that government entities notify the attorney general's office of breaches affecting 250 or more Texans within thirty days of discovery, and the district complied with this obligation. The district's spokeswoman stated that the ongoing investigation prevented her from confirming whether any ransom was paid to the attackers. Alamo Heights ISD's cyber insurance covered more than thirty‑six thousand dollars in costs to restore systems after the attack.
The incident is consistent with a pattern of ransomware activity targeting Texas school districts, as Judson ISD paid a ransom exceeding five hundred thousand dollars in 2021 and Uvalde CISD canceled classes for part of a week in September due to a similar attack. In response to growing threats, the Texas Legislature passed Senate Bill 820 in 2019, requiring school districts to adopt cybersecurity policies, designate a cybersecurity coordinator, and establish a process for reporting breaches to the Texas Education Agency. The Texas Education Agency launched a K‑12 Cybersecurity Initiative in 2023 to help districts prevent ransomware and phishing attacks, and legislators later approved an additional forty‑two million dollars in funding to sustain the program through 2027.