Your door badges are on the network. Three districts and two hospitals just proved it.

1. Saturday, October 17.Jerome, Idaho.School district

   Alerts fired overnight and teachers started reporting that the network was wrong. By the time the Jerome School District, about 4,000 students across eight schools, understood what was happening, attackers controlled the surveillance cameras, the electronic door locks, the heating and cooling, and the internet. The district closed every school Monday and Tuesday and rescheduled parent-teacher night. Attackers accessed student data and demanded a ransom; the district has declined to say whether it paid. Superintendent Brent Johnson called the cameras, locks and HVAC “core systems to make sure that our students are safe.” Schools reopened Wednesday.

2. The same weekend.Falls City, Nebraska.Hospital

   Community Medical Center locked down its computer systems after unauthorized access damaged parts of the network. Ambulances diverted critical patients to other hospitals because images could no longer reach radiologists. Appointments were canceled or delayed, staff went back to pen and paper, and the emergency room stayed open. The hospital decided to replace its computers and deploy an entirely new network, with expedited equipment shipments and help from a larger health system. The CEO expected slower services for most of the following week. Local reporting named a ransomware group; that attribution has yet to be independently established.

3. Tuesday, October 21.Richmond, Virginia.School district

   Teachers at Richmond Public Schools arrived to ransom notes on their laptops and no Wi-Fi, cameras, phones, copiers, Smartboards, Chromebooks or PowerSchool. A week later, the network was still unavailable and the district was still teaching without its digital resources.

4. Wednesday, October 22.Oneonta, New York.School district

   Oneonta City School District discovered a separate ransomware attack and closed schools Friday and Monday while it worked out what was affected, including whether student records were taken.

5. Monday, October 26.Albuquerque, New Mexico.Health system

   UNM Health diverted ambulance traffic to other area health systems from 12:30 to 2:30 p.m. MT while security teams protected the network. Clinical appointments and Health Sciences classes were canceled. Normal operations returned the next day. A group has claimed patient, student and employee data on a leak site. UNM has confirmed none of it, calls the incident a cybersecurity event under criminal investigation, and told the public to ignore anyone claiming responsibility.

That is five organizations in two sectors inside ten days, with different attackers as far as anyone has confirmed. The incidents follow the same pattern.

Field Notes No. 02 opened with the sentence that the ransomware call rarely starts with “our files are encrypted.” It starts with something more immediate: “the phones are down, the badge readers stopped working, and the cameras are dark.” Jerome was that sentence, word for word.

The mechanism is familiar to anyone who has walked a school or a hospital with a network diagram. Over the last decade, many of the systems that keep a building safe moved onto the same network as everything else: cameras, badge readers, HVAC controllers, bell schedules, PA systems, the visitor kiosk at the front office. In the environments we assess, most of them authenticate against the same directory as the staff laptops, sit on the same flat VLAN as the student information system, and get managed from the same admin workstation (the convenience is real, which is how it happens). Attackers who hold one administrator account usually hold all of it. They do the walking-around work first: map the environment, find the recovery infrastructure, find the physical systems. The encryption comes last, which is why the first symptom is a door that will neither lock nor unlock.

That ordering turns an IT outage into a safety decision. A superintendent with no cameras and no working locks will close the building. A hospital that has no way to move images to a radiologist will divert an ambulance. By then the outage has already cost the week, whatever happens with the ransom.

It also decides your restore order, the subject No. 02 spent the most time on. Safety systems are the first thing attackers take and the reason the building stays closed, so they belong in the Tier 1 recovery group next to identity and phones, with their own documented restore steps and their own manual overrides. Most plans I review file them under facilities, and facilities usually has no restore procedure for them.

There is no public attribution tying the school incidents above to any single vulnerability, and I will keep it that way. What is public is which entry point is being used across these sectors right now.

Unit 42, the research team at Palo Alto Networks, reports that ransomware operators have been exploiting CVE-2026-0257, a critical authentication bypass in PAN-OS GlobalProtect portals and gateways, since June 2026, with updated activity reported in October. Attackers establish VPN sessions without valid credentials, sidestep multi-factor authentication, and move laterally. Named victim sectors include education, healthcare and government. A patch is available. One tactic stood out in the reporting: pivoting into the virtualization layer to disable security controls and dump credentials. Your hypervisor is part of the attack path now, which is worth reading alongside this week’s other headline, a VMware ESX logging flaw that CISA added to its Known Exploited Vulnerabilities catalog after a state-linked group used it to erase audit trails.

The same week, Microsoft 365 tenants at 79 organizations were compromised by replaying stolen session tokens, with attackers registering rogue devices and rewriting inbox rules to keep access behind the MFA prompt. MFA stays mandatory, and it stops being sufficient the moment an edge device or a token is the thing being stolen. In No. 10 one client went from about 60% to about 95% patch compliance by automating the work; the GlobalProtect bypass is the kind of hole that difference closes.

Perimeter VPNs, firewalls and the virtualization layer are the three places this month’s attackers are living. They need a shorter patch clock than the general estate, measured in days, and a backup design that assumes the hypervisor administrator account is already gone, which is the design No. 04 lays out.

Jerome and Oneonta each lost two school days. Richmond was still down a week later. Falls City budgeted most of a week and bought new computers. UNM diverted ambulances for two hours and was normal the next morning.

Those are five different recovery time objectives, and only the organizations involved know what drove each one. The pattern across the incidents we have worked matches it, though. Recovery time comes down to three things: whether the organization can rebuild identity and core networking into a clean environment quickly, whether it holds a copy of the data attackers could neither encrypt nor delete, and whether anyone has rehearsed the order things come back in. Falls City’s decision to stand up an entirely new network is the heavy version of a clean rebuild, done under pressure with trucks of hardware. A pre-staged recovery environment is the same decision made in advance.

The No. 02 sequence still holds: contain and declare, then identity and network into a clean environment, then the systems that decide whether the building opens, then everything else in a business-approved order, then prove the attacker is gone before you call it recovered. Ten days of headlines changed none of it. They added evidence for the part most of the plans we review skip, which is timed restore tests run before the bad morning, with the safety systems in scope.

A hospital’s recovery time shows up as ambulance diversions. UNM’s two-hour window and Falls City’s radiology bottleneck teach the same lesson at two scales. A dependency that looks like plumbing becomes a clinical decision the moment it fails, and the image transfer to the radiologist, the lab interface and the bed board all belong on the Tier 1 list with a known manual fallback and a known restore time.

Two things UNM did deserve copying. It communicated through channels it controlled and told the public to engage with nobody claiming responsibility, which keeps the attacker out of the narrative and keeps staff from clicking on things. And it described the incident only in terms it could prove, a cybersecurity event under investigation, rather than repeating the attacker’s claims. Discipline in the first 48 hours is part of the recovery plan, and it can be written down in advance like everything else.

1. 01

   Inventory every physical system on the network, then segment it. Cameras, badge readers, HVAC, PA, bells, visitor management. Each gets its own VLAN, its own credentials, and a documented manual override: who holds the physical keys, how the heat runs without the controller, how a building opens with the badge system down.

2. 02

   Put the edge and the hypervisor on a days-long patch clock. GlobalProtect and the ESX flaw in CISA’s catalog are this month’s examples. Measure compliance monthly and report the number to leadership, the way No. 10 describes.

3. 03

   Hold one copy attackers can neither encrypt nor delete. Immutable, outside production credentials, restore-tested. The replication target and the backup console must stop trusting the same directory as the laptops.

4. 04

   Write the restore order with safety systems in Tier 1. Identity, network, phones, badges and cameras, then the student information system or the clinical systems, then everything else. Name the owner of each item.

5. 05

   Rehearse it with a stopwatch, and decide the hard questions in advance. Who declares, who calls the insurer and counsel, which channel the incident team uses when email is gone, and what the organization’s position on paying is before anyone is asking at 2 a.m.

This section describes our own services, so read it with that in mind.

The districts and hospitals above each had an IT team doing everything it could on the morning it happened. The difference between a two-hour incident and a two-week one is work done months earlier, and that work is what we sell. In our co-managed model we operate the recovery side of a customer’s existing environment: the immutable copy, the documented restore order with physical and clinical systems in Tier 1, and the scheduled, timed restore tests with results leadership and insurers can read. In our hosted model, replication flows into recovery infrastructure we operate in our Pennsylvania and Arizona data center regions, pre-staged and isolated from the customer’s production credentials, so the clean environment already exists on the bad morning instead of arriving on a truck.

We work with school districts and local governments on familiar procurement paths, and the first engagement is usually a restore test rather than a purchase.

Disclosure: Section 07 describes ModernOps services. The incident details above come from the organizations’ own statements and the reporting linked in Sources, as of October 29, 2026; attacker claims are marked unverified and details may change. Validate every control against your own environment.

Read these aloud. Any “no” belongs on the plan before the next headline.

If the renewal clock or the budget cycle already has you reviewing the environment, the free Rapid Infrastructure Resiliency Assessment scores backup, recoverability, immutability and failure tolerance, remote-first, with a prioritized plan you can take to a board or a school committee.

Next in Field Notes: Workday and on-prem Active Directory. What Entra already does between them, what it leaves you to build, and why Microsoft’s own documentation answers the hardest part with “write a PowerShell script and schedule it.”