Uvalde CISD suffered a ransomware attack in September 2025, attributed to the Qilin ransomware group, which disrupted critical operations including phones, air conditioning, security cameras, visitor management, and the Skyward system. Schools were forced to close from September 15 to 18. While the district initially stated there was no evidence of unauthorized access to sensitive or personal data, Qilin contradicted this claim, asserting it had stolen personal data of employees, financial records, and student information, even posting alleged stolen documents as proof. The attack caused operational paralysis, affecting attendance, communications, and administrative functions. The district denied staff error as the cause and is conducting an ongoing investigation. Qilin, a ransomware-as-a-service (RaaS) group, has a history of targeting educational institutions, with Uvalde CISD being one of several recent victims in the US and Australia. The breach poses risks of fraud, identity theft, and prolonged recovery challenges, compounded by the education sector’s notoriously slow breach notification timeline (average 4.8 months). The financial and reputational damage remains undetermined, but the attack underscores the growing threat of ransomware in public education.