A cybercriminal group called LockBit yesterday took credit for a May 2026 ransomware attack on Delano Public Schools in Minnesota.

The district detected the attack on May 19 when several district printers printed messages that included the word “ransomware,” according to the Delano Herald Journal. The district cancelled classes on the following day and said its servers had been accessed by an outside threat actor.

One June 9, LockBit claimed responsibility for the attack on its data leak website. LockBit says it stole data from Delano Public Schools and is demanding the district pay an undisclosed amount in ransom within the next two weeks.

“We are still feeling the effects of the recent cybersecurity incident,” said Delano Public Schools director of communications Bobbie Dahlke in an email to Comparitech. “We are confident that student and staff data was not compromised. Our system locked them out early on.”

Dahlke said LockBit breached the district’s network through a firewall and compromised old file folders. The ransomware group made several threats before demanding $1.2 million in ransom.

“We did not pay,” Dahlke said. “LockBit is a sanctioned organization and legally we cannot pay.”

Who is LockBit?

LockBit is a Russia-based cybercriminal gang that first appeared in 2019. Its malware both locks down computers and steals data. LockBit operates a ransomware-as-a-service scheme in which affiliates pay to use LockBit’s malware and infrastructure to launch attacks and collect ransoms.

LockBit has taken credit for 165 ransomware attacks in 2026 to date. Of those, 20 were confirmed by the targeted organizations. One other target was a school; Alcorn School District reported a data breach in March.

LockBit’s latest confirmed attack hit Brazilian government healthcare organization Secretaria de Estado de Saude de Mato Grosso, which said it refused to pay a $500,000 ransom.

Ransomware attacks on US education

Comparitech researchers have logged 11 confirmed ransomware attacks on US schools, universities, and other educational institutions in 2026 to date.

Earlier this week, Evanston Township High School District 202 in Chicago cancelled classes for two days after a ransomware attack.

Ransomware attacks on schools can both steal data and disrupt day-to-day operations such as taking attendance, submitting grades, phone and email communications, billing, payroll, and assignments. Schools that refuse to pay can face extended downtime, permanent data loss, and putting students and faculty at increased risk of fraud.

About Delano Public Schools

Delano Public Schools is located just west of Minneapolis and consists of one elementary, one intermediate, and one high school, plus a community education center. It enrolls about 2,400 students and employs 370 staff, according to its website.