Cyber Incident Victim: Alamo Heights Independent School District
Date:
Mar 2026
Location:
United States of America
Summary
Alamo Heights Independent School District experienced a network intrusion that caused connectivity issues, which officials said was resolved with the assistance of external forensic investigators and reported to the Federal Bureau of Investigation. A spokeswoman declined to say whether the district paid a ransom, citing the ongoing investigation, and noted that the FBI does not support ransom payments because they do not guarantee data recovery and may lead to further demands. Former FBI agent William Odom explained that attackers often gain access through phishing emails and that paying a ransom carries significant risk, especially for school districts with limited budgets and security resources.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On March 23, Alamo Heights Independent School District officials noticed connectivity problems affecting the district's network. By March 27, the district informed families that the issue had been resolved and that technology systems had been restored with the assistance of external forensic investigators. The officials stated that the external threat no longer had access to the district's network after the restoration work. In conjunction with the restoration, the district reported the incident to the Federal Bureau of Investigation. The spokeswoman communicated her statements to the public via email.
A district spokeswoman declined to disclose whether the district had paid a ransom to the attackers, citing the ongoing investigation as the reason for non-disclosure. She noted that, due to the complexity of the incident, the investigation was expected to take several weeks to complete even after systems were restored. The spokeswoman also referenced the FBI's position that paying a ransom does not guarantee data recovery and that the agency does not support paying ransoms in response to such attacks. The incident disrupted normal district operations while connectivity problems persisted before the March 27 resolution. She said the district was diligently working to identify the full scope of the information involved.