A cybercriminal group called LockBit yesterday took credit for a May 2026 ransomware attack on Delano Public Schools in Minnesota.
The district detected the attack on May 19 when several district printers printed messages that included the word “ransomware,” according to the Delano Herald Journal. The district cancelled classes on the following day and said its servers had been accessed by an outside threat actor.
One June 9, LockBit claimed responsibility for the attack on its data leak website. LockBit says it stole data from Delano Public Schools and is demanding the district pay an undisclosed amount in ransom within the next two weeks.
Delano Public Schools has not acknowledged LockBit’s claim and Comparitech cannot independently verify its authenticity. We do not know what data was compromised, how attackers breached the district’s network, if the district did or will pay a ransom, or how much LockBit demanded. Comparitech contacted Delano Public Schools and will update this article if it replies.
Who is LockBit?
LockBit is a Russia-based cybercriminal gang that first appeared in 2019. Its malware both locks down computers and steals data. LockBit operates a ransomware-as-a-service scheme in which affiliates pay to use LockBit’s malware and infrastructure to launch attacks and collect ransoms.
LockBit has taken credit for 165 ransomware attacks in 2026 to date. Of those, 20 were confirmed by the targeted organizations. One other target was a school; Alcorn School District reported a data breach in March.
LockBit’s latest confirmed attack hit Brazilian government healthcare organization Secretaria de Estado de Saude de Mato Grosso, which said it refused to pay a $500,000 ransom.
Ransomware attacks on US education
Comparitech researchers have logged 11 confirmed ransomware attacks on US schools, universities, and other educational institutions in 2026 to date.
Earlier this week, Evanston Township High School District 202 in Chicago cancelled classes for two days after a ransomware attack.
Ransomware attacks on schools can both steal data and disrupt day-to-day operations such as taking attendance, submitting grades, phone and email communications, billing, payroll, and assignments. Schools that refuse to pay can face extended downtime, permanent data loss, and putting students and faculty at increased risk of fraud.
About Delano Public Schools
Delano Public Schools is located just west of Minneapolis and consists of one elementary, one intermediate, and one high school, plus a community education center. It enrolls about 2,400 students and employs 370 staff, according to its website.