Two technology directors left Richmond Public Schools in the months before a cyberattack took the district’s network offline, and their resignation letters show both men warned that the department was in trouble. WTVR CBS 6 obtained the letters through a Freedom of Information Act request and published its report on November 13, 2026. The letters give the clearest picture yet of conditions inside the division’s Technology Services department before the attack. The Richmond schools cyberattack began on October 21, 2026, when the district detected suspicious activity on its network.
Two warnings before the Richmond schools cyberattack
Jason Bruffey was the first of the two directors to leave. In June 2025 he told Chief of Staff Shareyna Chang that he would not return for the 2025-26 school year. Bruffey wrote that he could no longer continue in the position because of what he described as significant financial and structural challenges in the department. His last day was June 30, 2025.
Tim Tillman followed about 15 months later. In a September 2026 resignation letter, Tillman wrote about the “foundational changes required within the IT department and the division as a whole.” He said he did not believe he was the right person to lead that work. His last day was October 1, 2026.
Twenty days later, the district found suspicious activity on its network, and Superintendent Jason Kamras confirmed that Richmond Public Schools was dealing with a cybersecurity incident. The timing put the Richmond schools cyberattack three weeks after the department lost its second director in 15 months.
What the Richmond schools cyberattack shut down
The attack forced the district to take its internet offline across Richmond Public Schools, disrupting phone and email service and limiting access to online classroom tools and learning platforms. Teachers and students lost access to digital lessons while the technology team worked to contain the incident and build a workaround.
The district later said data accessed during the Richmond schools cyberattack may have been posted on the dark web. Threat actors claimed they had taken personal information belonging to current and former students, staff and contractors. The categories listed in the district’s notice included names, birth dates, phone numbers, addresses, driver’s license numbers, Social Security numbers, passport numbers, military identification numbers, health insurance numbers and some medical information tied to educational or employment needs. The district has not said how many people were affected or which records were exposed.
Richmond Public Schools expanded its offer of free identity monitoring to former students and former employees after the Richmond schools cyberattack, having first offered it to current students and employees on October 23. The monitoring is provided through Experian, and the district has shared instructions for enrollment online.
Who is running technology now
Chief Operating Officer Patrick Herrell has served as interim IT director since October 1, 2026, the day Tillman left. The district said it is conducting a nationwide search for a permanent IT director. CBS 6 asked the district to explain what Tillman meant by the changes he described, and the district did not answer that question. It did confirm who was overseeing technology after his departure.
Superintendent Kamras has also faced questions at public meetings about the forensic audit now under way and about when the technology director post will be filled. At a school board meeting on Tuesday night, Herrell read a statement saying the audit is under way and that the division cannot answer some questions while the matter is under investigation with federal officials.
The Richmond schools cyberattack investigation
Richmond Public Schools said it is cooperating with the FBI’s Cyber Crimes Division, the Virginia State Police’s Virginia Cyber Fusion Center and the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency. The technology team is working to build a permanent network and has carried out a division-wide password reset after the Richmond schools cyberattack, a step the district described as common and recommended after an incident of this kind.
The two resignation letters do not say the attack could have been prevented, and neither director linked his departure to a specific threat. What they do show is that the department’s leadership turned over twice in the 15 months before the Richmond schools cyberattack, and that both men put their concerns in writing before they left. The district’s recovery work is still under way, and the forensic audit has not yet produced a public account of how the attackers got in.