Your Door Badges Are on the Network

Between October 17 and October 26, 2026, ransomware closed three school districts and sent two hospitals back to paper. In Idaho the attackers took the cameras, the door locks and the heat before anyone saw a ransom note. Here is what ten days of headlines say about the recovery plan you have, and the five moves to make before the next one.

01 — The incidents: Ten days, in order

Saturday, October 17. Jerome, Idaho. School district

Alerts fired overnight and teachers started reporting that the network was wrong. By the time the Jerome School District, about 4,000 students across eight schools, understood what was happening, attackers controlled the surveillance cameras, the electronic door locks, the heating and cooling, and the internet. The district closed every school Monday and Tuesday and rescheduled parent-teacher night. Attackers accessed student data and demanded a ransom; the district has declined to say whether it paid. Superintendent Brent Johnson called the cameras, locks and HVAC “core systems to make sure that our students are safe.” Schools reopened Wednesday.

The same weekend. Falls City, Nebraska. Hospital

Community Medical Center locked down its computer systems after unauthorized access damaged parts of the network. Ambulances diverted critical patients to other hospitals because images could no longer reach radiologists. Appointments were canceled or delayed, staff went back to pen and paper, and the emergency room stayed open. The hospital decided to replace its computers and deploy an entirely new network, with expedited equipment shipments and help from a larger health system. The CEO expected slower services for most of the following week. Local reporting named a ransomware group; that attribution has yet to be independently established.

Tuesday, October 21. Richmond, Virginia. School district

Teachers at Richmond Public Schools arrived to ransom notes on their laptops and no Wi-Fi, cameras, phones, copiers, Smartboards, Chromebooks or PowerSchool. A week later, the network was still unavailable and the district was still teaching without its digital resources.

Wednesday, October 22. Oneonta, New York. School district

Oneonta City School District discovered a separate ransomware attack and closed schools Friday and Monday while it worked out what was affected, including whether student records were taken.

Monday, October 26. Albuquerque, New Mexico. Health system

UNM Health diverted ambulance traffic to other area health systems from 12:30 to 2:30 p.m. MT while security teams protected the network. Clinical appointments and Health Sciences classes were canceled. Normal operations returned the next day. A group has claimed patient, student and employee data on a leak site. UNM has confirmed none of it, calls the incident a cybersecurity event under criminal investigation, and told the public to ignore anyone claiming responsibility.

That is five organizations in two sectors inside ten days, with different attackers as far as anyone has confirmed. The incidents follow the same pattern.

02 — The mechanism: Why the door locks go first

Field Notes No. 02 opened with the sentence that the ransomware call rarely starts with “our files are encrypted.” It starts with something more immediate: “the phones are down, the badge readers stopped working, and the cameras are dark.” Jerome was that sentence, word for word.

The mechanism is familiar to anyone who has walked a school or a hospital with a network diagram. Over the last decade, many of the systems that keep a building safe moved onto the same network as everything else: cameras, badge readers, HVAC controllers, bell schedules, PA systems, the visitor kiosk at the front office. In the environments we assess, most of them authenticate against the same directory as the staff laptops, sit on the same flat VLAN as the student information system, and get managed from the same admin workstation (the convenience is real, which is how it happens). Attackers who hold one administrator account usually hold all of it. They do the walking-around work first: map the environment, find the recovery infrastructure, find the physical systems. The encryption comes last, which is why the first symptom is a door that will neither lock nor unlock.

That ordering turns an IT outage into a safety decision. A superintendent with no cameras and no working locks will close the building. A hospital that has no way to move images to a radiologist will divert an ambulance. By then the outage has already cost the week, whatever happens with the ransom.

It also decides your restore order, the subject No. 02 spent the most time on. Safety systems are the first thing attackers take and the reason the building stays closed, so they belong in the Tier 1 recovery group next to identity and phones, with their own documented restore steps and their own manual overrides. Most plans I review file them under facilities, and facilities usually has no restore procedure for them.

03 — Threat intelligence: The entry point attackers are using this month

There is no public attribution tying the school incidents above to any single vulnerability, and I will keep it that way. What is public is which entry point is being used across these sectors right now.

Unit 42, the research team at Palo Alto Networks, reports that ransomware operators have been exploiting CVE-2026-0257, a critical authentication bypass in PAN-OS GlobalProtect portals and gateways, since June 2026, with updated activity reported in October. Attackers establish VPN sessions without valid credentials, sidestep multi-factor authentication, and move laterally. Named victim sectors include education, healthcare and government. A patch is available. One tactic stood out in the reporting: pivoting into the virtualization layer to disable security controls and dump credentials. Your hypervisor is part of the attack path now, which is worth reading alongside this week’s other headline, a VMware ESX logging flaw that CISA added to its Known Exploited Vulnerabilities catalog after a state-linked group used it to erase audit trails.

The same week, Microsoft 365 tenants at 79 organizations were compromised by replaying stolen session tokens, with attackers registering rogue devices and rewriting inbox rules to keep access behind the MFA prompt. MFA stays mandatory, and it stops being sufficient the moment an edge device or a token is the thing being stolen. In No. 10 one client went from about 60% to about 95% patch compliance by automating the work; the GlobalProtect bypass is the kind of hole that difference closes.

Perimeter VPNs, firewalls and the virtualization layer are the three places this month’s attackers are living. They need a shorter patch clock than the general estate, measured in days, and a backup design that assumes the hypervisor administrator account is already gone, which is the design No. 04 lays out.

04 — Recovery: Recovery times inside the same ten days

Jerome and Oneonta each lost two school days. Richmond was still down a week later. Falls City budgeted most of a week and bought new computers. UNM diverted ambulances for two hours and was normal the next morning.

Reported time to normal operations, October 17 to 26, 2026

• UNM Health (Albuquerque, health system): 2-hour ambulance diversion, normal the next morning
• Jerome School District (Idaho, K-12): 2 school days closed
• Oneonta City School District (New York, K-12): 2 school days closed
• Community Medical Center (Falls City, Nebraska, hospital): Most of a week, on new computers and a new network
• Richmond Public Schools (Virginia, K-12): Network still unavailable a week later

Reported closure or reduced-service window from each organization’s statements and the coverage listed in Sources. Richmond was still down when this note was filed.

Those are five different recovery time objectives, and only the organizations involved know what drove each one. The pattern across the incidents we have worked matches it, though. Recovery time comes down to three things: whether the organization can rebuild identity and core networking into a clean environment quickly, whether it holds a copy of the data attackers could neither encrypt nor delete, and whether anyone has rehearsed the order things come back in. Falls City’s decision to stand up an entirely new network is the heavy version of a clean rebuild, done under pressure with trucks of hardware. A pre-staged recovery environment is the same decision made in advance.

The No. 02 sequence still holds: contain and declare, then identity and network into a clean environment, then the systems that decide whether the building opens, then everything else in a business-approved order, then prove the attacker is gone before you call it recovered. Ten days of headlines changed none of it. They added evidence for the part most of the plans we review skip, which is timed restore tests run before the bad morning, with the safety systems in scope.

05 — Healthcare: The hospital version

A hospital’s recovery time shows up as ambulance diversions. UNM’s two-hour window and Falls City’s radiology bottleneck teach the same lesson at two scales. A dependency that looks like plumbing becomes a clinical decision the moment it fails, and the image transfer to the radiologist, the lab interface and the bed board all belong on the Tier 1 list with a known manual fallback and a known restore time.

Two things UNM did deserve copying. It communicated through channels it controlled and told the public to engage with nobody claiming responsibility, which keeps the attacker out of the narrative and keeps staff from clicking on things. And it described the incident only in terms it could prove, a cybersecurity event under investigation, rather than repeating the attacker’s claims. Discipline in the first 48 hours is part of the recovery plan, and it can be written down in advance like everything else.

06 — The plan: Five moves before the next one

1. Inventory every physical system on the network, then segment it. Cameras, badge readers, HVAC, PA, bells, visitor management. Each gets its own VLAN, its own credentials, and a documented manual override: who holds the physical keys, how the heat runs without the controller, how a building opens with the badge system down.
2. Put the edge and the hypervisor on a days-long patch clock. GlobalProtect and the ESX flaw in CISA’s catalog are this month’s examples. Measure compliance monthly and report the number to leadership, the way No. 10 describes.
3. Hold one copy attackers can neither encrypt nor delete. Immutable, outside production credentials, restore-tested. The replication target and the backup console must stop trusting the same directory as the laptops.
4. Write the restore order with safety systems in Tier 1. Identity, network, phones, badges and cameras, then the student information system or the clinical systems, then everything else. Name the owner of each item.
5. Rehearse it with a stopwatch, and decide the hard questions in advance. Who declares, who calls the insurer and counsel, which channel the incident team uses when email is gone, and what the organization’s position on paying is before anyone is asking at 2 a.m.

07 — Our services: How we run this at ModernOps

This section describes our own services, so read it with that in mind.

The districts and hospitals above each had an IT team doing everything it could on the morning it happened. The difference between a two-hour incident and a two-week one is work done months earlier, and that work is what we sell. In our co-managed model we operate the recovery side of a customer’s existing environment: the immutable copy, the documented restore order with physical and clinical systems in Tier 1, and the scheduled, timed restore tests with results leadership and insurers can read. In our hosted model, replication flows into recovery infrastructure we operate in our Pennsylvania and Arizona data center regions, pre-staged and isolated from the customer’s production credentials, so the clean environment already exists on the bad morning instead of arriving on a truck.

We work with school districts and local governments on familiar procurement paths, and the first engagement is usually a restore test rather than a purchase.

Disclosure: Section 07 describes ModernOps services. The incident details above come from the organizations’ own statements and the reporting linked in Sources, as of October 29, 2026; attacker claims are marked unverified and details may change. Validate every control against your own environment.

08 — Assessment: The 60-second check

Read these aloud. Any “no” belongs on the plan before the next headline.

• Every camera, badge reader and HVAC controller sits on a segmented network with its own credentials, and someone can open the building and run the heat with all of them offline.
• The VPN, firewalls and hypervisor have been patched within days of the last critical advisory, and you can show the number.
• At least one backup copy is immutable and unreachable with production administrator credentials.
• A written restore order exists, safety and clinical systems are in Tier 1, and each entry has an owner.
• A timed restore test ran in the last six months and the incident team has a communication channel that survives losing email.

If the renewal clock or the budget cycle already has you reviewing the environment, the free Rapid Infrastructure Resiliency Assessment scores backup, recoverability, immutability and failure tolerance, remote-first, with a prioritized plan you can take to a board or a school committee.

09 — Primary reading: Sources

• Cybernews: Hackers take control of school cameras, locks, and HVAC, shutting down entire Idaho school district (Jerome School District, October 17; superintendent quotes)
• Becker’s Hospital Review: Cyberattack diverts critical patients from Nebraska hospital (Community Medical Center, weekend of October 17 to 18)
• MSC News: CMC in Falls City targeted by Cyber Attack (Community Medical Center)
• Kaseya: The Week in Breach News: October 28, 2026 (Richmond Public Schools, October 21; Oneonta City School District, October 22)
• Cyware: Cyware Daily Threat Intelligence, October 24, 2026 (Oneonta closure; Unit 42 reporting on CVE-2026-0257 exploitation; Microsoft 365 token-replay campaign)
• UNM Health Sciences: Ambulance traffic diverted, clinical appointments cancelled and classes cancelled due to cybersecurity issue at UNM HSC (October 26 to 28, with follow-up guidance)
• HIPAA Journal: University of New Mexico Health System Diverts Ambulances Due to Ransomware Attack
• The Hacker News: China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility (CVE-2026-41709, CISA KEV)
• ModernOps: Field Notes No. 02, No. 04 and No. 10, for the recovery sequence, the immutability rules and the patch-compliance results this piece builds on

Ryan Beglau, filed from Conshohocken, PA, October 2026

Originally published at modernops.com.

Disclosure: I work for ModernOps, and section 07 describes our own recovery services. The incident details come from the organizations' statements and the public reporting listed in Sources, as of October 29, 2026. Validate every control against your own environment.