They didn't close school over stolen files. They closed it over the door locks.

On the morning of Saturday, October 17, the Jerome School District in southern Idaho started getting alerts from its own systems, and teachers started reporting network problems. By Monday it had cancelled classes for roughly 4,000 students. It cancelled Tuesday too. Schools reopened this morning.

Superintendent Brent Johnson told KMVT what the attackers had reached: “When you're talking about cameras and door locks and our air-conditioning and heating systems.” Those, he said, are “core systems to make sure that our students are safe,” which is why closing was the best option.

Read the list again. Not the student information system. Not email. Not the gradebook. Cameras, electronic door locks, and heating and air. The district closed because it could not safely put children inside the buildings — a different kind of loss than the one nearly every incident response plan is written for.

The question that actually closes a building

Most plans answer a data question: what was taken, who gets notified, how fast can we restore. Those matter. They are not what a superintendent, a city manager or a 911 director has to answer at six in the morning.

The question is whether the building can be occupied and operated today. A restored file server does not open a door, aim a camera, or hold a server room at 68 degrees.

Backups don't answer it. Insurance doesn't answer it. Knowing in advance which of your building's systems stop when the network does — that answers it.

Georgia has already lived the milder version

Newton County Schools, in Covington, identified a cybersecurity incident on July 27, 2026, days before the first day of classes. Its own incident page records the recovery: phones back July 31, full network services restored August 6, after nine days. As of its August 11 FAQ the district said it had “no indication that personal information from this incident has been used to commit identity theft or fraud.”

Newton County has not said cameras or door access were involved, and we are not suggesting they were. The narrower point is harder to dodge: a Georgia district opened a school year with no phones for four days and no network for nine, and still had to run its buildings.

Your building went onto the network without anyone deciding it should

Walk a city hall, a county annex, a 911 center or a school wired fifteen years ago and look at what has been replaced since. Analog cameras became IP cameras on a recorder. The card panel became a browser-managed access control system. Thermostats became networked controllers with a web interface. Intercom, bells and clocks became IP devices. The panic button became an app.

Each was bought on a facilities, safety or capital line rather than an IT line, installed by a different contractor, usually with remote support so the vendor does not have to drive out. None of that is wrong. The problem is that nobody added them to the IT inventory, so they are not patched on a schedule, not segmented, and not in the recovery plan.

Federal guidance already treats them as infrastructure. NIST Special Publication 800-82r3, the government's guide to operational technology security, lists “building automation systems” and “physical access control systems” in the same scope as industrial control systems. CISA's Internet Exposure Reduction Guidance, issued in August 2026, urges organizations to route necessary remote access “through a secure gateway, firewall, VPN, or other centrally managed access solution” rather than straight to a controller — and is clear that the fix is not unplugging: “internet exposure reduction does not mean disabling necessary remote access.”

Georgia schools just added one more of these systems

House Bill 268 put two network-dependent life-safety systems into every Georgia public school. Under O.C.G.A. § 20-2-591, “not later than July 1, 2026, each public school shall implement a mobile panic alert system,” integrated with 911 and with the school's mapping data. Under § 38-3-154, schools had to procure that mapping data by the same date, and the producing entity has to verify its accuracy every year by July 1 through an in-person inspection of each school.

If your district stood those up over the summer, they belong on the list of things that have to work on a bad day, and that annual verification is a recurring deadline worth calendaring now.

For scale: Comparitech counted 77 ransomware attacks on education worldwide in the third quarter of 2026, 31 of them in the United States, median demand $510,000. But one quarter is not a trend; the same researchers found US education attacks down 44 percent over the first half of the year. Don't act on the odds. Act on the blast radius.

Four questions that decide whether you open

Run these on one building, out loud, with the people who would have to answer them at 6 a.m.

• Can we see? Where does the recorder physically live, does it keep recording with the internet gone, and how many days are retained?
• Can we control the doors? If the access control server is down, do readers keep working on cached credentials, and for how long? Who holds mechanical keys? Which doors fail secure and which fail safe when power or control is lost, and does that match what your fire marshal expects?
• Can we keep it usable? Can someone put HVAC, server room cooling and refrigeration into local or manual mode at the panel without a network, and does a named person know how?
• Can we call for help? Phones, intercom, bells, panic alert, elevator phones, and the fire alarm's communication path. Which of those ride the data network, and which are genuinely independent of it? Most organizations have at least one they have guessed wrong about.

What to do, in order

1. Write the list, and mark what survives. One page: every device in the building with an IP address that isn't a PC, phone or printer. Who installed it, who supports it, and yes/no/partly on one question — with the network down, does this still do its job? The “no” lines are your occupancy risk.
2. Find every remote connection. Ask each vendor in writing how they reach that system: named accounts or a shared login, multi-factor or not, and through what. Hold the answers against CISA's rule — through a managed gateway, never straight to the controller.
3. Separate them, then clear the easy wins. Put building systems on their own VLAN with rules for what they may talk to; most have no business reaching the office network or the open internet. Then kill default and shared passwords, replace firmware nobody updates anymore, and close anything reachable from outside.
4. Back up the configurations, not just the video. Cardholder database, door groups and schedules, camera and controller configs, panel programming — a copy kept off the system itself. Rebuilding a card database by hand is what turns a two-day recovery into a two-week one.
5. Write the manual-mode page, then test it. Keys, local overrides, who is authorized, who gets called. Then try it with the network off, on a Saturday, before someone has to improvise it.
6. Decide the occupancy rule now. Put in writing which of these systems being down means you do not open. Jerome's superintendent had to make that call on a Sunday; it is a better decision made in October than at 5 a.m. in January.

One thing not to do: don't pull a listed fire alarm panel onto the IT network so it can be “managed” like everything else. Standing apart from the data network is the feature. The job is to know which systems are genuinely independent, not to make them all the same.

If you want help running this

Southern Technology Partners works out of Hazlehurst, roughly a hundred miles in every direction. We do managed IT and the low-voltage side both — cabling, CCTV, access control, fire and alarm — which is why an inventory like this one gets finished here instead of stalling between contractors who each see one column of it.

If you already have an IT provider and aren't looking to change, ask them the four questions above and see how fast they come back. If the answers are thin, call us and we'll walk one building with you.

Southern Technology Partners LLC

15 Latimer St., Hazlehurst, GA 31539· (912) 209-4804·southerntechpartners.net

Sources

1. KMVT, “Jerome schools to open Wednesday after weekend cyber attack targets district networks and demands ransom”, October 20, 2026.
2. KMVT, “Jerome School District cancels classes after cybersecurity incident”, October 18, 2026.
3. Idaho News 6 / KIVI, “Jerome schools closed Monday after weekend cyber attack”, October 21, 2026.
4. Cybernews, “Jerome School District cyberattack closes Idaho schools”, October 2026.
5. Newton County Schools, Cyber Incident Updates (district updates, July 27 – August 19, 2026).
6. Atlanta News First, “'Cybersecurity incident' impacts Newton County Schools' digital network, district says”, July 28, 2026.
7. Comparitech, “Education Ransomware Roundup: Q3 2026”, October 20, 2026.
8. NIST, Special Publication 800-82r3, Guide to Operational Technology (OT) Security, September 2023.
9. CISA, Internet Exposure Reduction Guidance, August 2026.
10. State of Georgia, House Bill 268 (2025), as passed — O.C.G.A. § 20-2-591 (mobile panic alert system) and § 38-3-154 (school mapping data).