San Antonio Ransomware Attack Lessons From 5 Local Incidents

I’m the CTO at Uprite. I read incident reports for a living, and I’ll be honest about why this post exists.

People keep searching for a City of San Antonio ransomware attack. A lot of people. So I went looking for the incident, through city press releases, local news archives and state announcements, and there isn’t one on the public record as of November 3, 2026. What San Antonio does have is a cluster of well documented attacks on schools, a university and a county appraisal office, a few of which published unusually honest accounts of what went wrong. Those are more useful to a business owner than a city hall story would have been anyway. Far more useful.

Why? Because a 40-person company runs its IT a lot more like a school district’s business office than like a city of 1.5 million people.

Was the City of San Antonio hit by ransomware?

No publicly confirmed ransomware attack has encrypted City of San Antonio systems as of November 3, 2026. The incidents people usually mean hit other San Antonio area organizations, including Judson ISD in 2021, the Bexar County Appraisal District in 2022 and UTSA in 2026. City departments weren’t the victim in any of them. Good news, mostly.

That’s not luck, exactly. Back in 2021 the city’s chief security officer, Patsy Boozer, described joint cyber exercises with CPS Energy, SAWS and federal agents, plus the unglamorous basics of patching servers and watching alerts. Boring work. It works.

Other Texas cities weren’t so fortunate. In August 2019 a single coordinated campaign hit 23 Texas local governments at once. Mission, down in the Rio Grande Valley, is another Texas city that got hit, and Governor Abbott named it when he signed House Bill 150 in San Antonio on June 2, 2025, creating the $135 million Texas Cyber Command headquartered at UTSA. And Dallas had its own City Hall attack in 2023, which we broke down separately in what Dallas City Hall learned the hard way.

So if you landed here looking for a San Antonio city government breach, that’s the answer. The lessons below come from the attacks that did happen here.

Which San Antonio area ransomware incidents have a public record?

Five incidents that touched San Antonio organizations, or landed within about 80 miles of downtown, have enough published detail to learn from. I kept this list to primary accounts, official statements and local reporting that quotes named officials. No rumor, no dark web chatter.

Only one of these involved a San Antonio public body actually paying a ransom, and it’s the one that later explained its decision in writing to Congress, in more detail than most companies ever share. It’s the most detailed public account of a ransomware attack I’ve read from any Texas organization, so it gets the most space here.

What did Judson ISD’s congressional testimony reveal?

In September 2023, Judson ISD’s Assistant Superintendent of Technology, Dr. Lacey Gosch, gave written testimony to a U.S. House oversight subcommittee on the district’s 2021 attack. It’s 8 pages. Read all of it if you run a business. It’s worth the time.

The short version goes like this. On June 17, 2021, a technician noticed a problem in the middle of the night, lost access to every internal system about 2 hours later, and by the time he reached the office every screen showed a ransom note from a group called PYSA, which the testimony describes as a strain that picked victims by their ability to pay. The attackers came in through a single technology employee’s device and pivoted through a video streaming server that was supposed to have no outside connection at all.

Then it got worse.

The district lost email, document access, payroll, purchasing, building access control and security cameras. It called local police, the county and the FBI. According to the testimony, each agency offered a case number and some reading material, and no law enforcement officer came to the property. If you are deciding who to report to and when, our guide to ransomware reporting rules and notice clocks covers the sequence. Gosch had been in the job for 34 days.

Three details in that document matter more to a business owner than the headline ransom figure, and each one is its own lesson below.

Lesson 1. Why didn’t Judson’s backups save it?

Because the backups reported success while the ransomware was quietly encrypting and deleting them. The testimony says the virtual server backups kept generating “successful” notifications, and the systems engineer discovered the malware was destroying each copy right after it was made. Green checkmarks. Nothing behind them. Nobody caught it in time.

What saved the district was old fashioned. The team had pulled removable drive backups the day before the attack and stored them off site, and those drives were intact. That’s the whole reason critical financial and student data came back. Cheap drives did that.

I’d put this one first for any business in Bexar County. A backup job that reports success is telling you it ran. It isn’t telling you the copy survives an attacker who already has admin rights on the same network, and it certainly isn’t telling you anyone has restored from it lately. Ask your provider 3 questions this week. Is at least one copy immutable or physically offline? When was the last full restore test? Can the account that runs backups also delete them?

If the answer to the last one is yes, fix that first. Get the answers in writing. Our San Antonio disaster recovery page covers recovery targets, and these questions to ask an MSP about backup go further than I have room for here.

Lesson 2. Why pay a ransom when you can restore?

Judson could restore. It paid anyway. The district told Congress it paid about $547,000 “not to obtain our data but to ensure the deletion of data captured by the threat actors,” after the attackers produced a full file listing and handed over 5 specific files the district asked for as proof, including files from a 10 year span.

That’s double extortion, and it changes the whole math. Good backups solve encryption. That’s the trap. They do nothing about a copy of your payroll file sitting on someone else’s server.

And the decryption keys the district received? The testimony says they contained additional malware, and the team stopped using them. Think about that. Paying bought a promise about deleted data. It didn’t buy a clean recovery.

Data theft is now the normal pattern, not the exception. The Verizon 2026 Data Breach Investigations Report found ransomware in 48% of breaches, and the pressure point in most of those cases is the stolen data. For a San Antonio business the practical takeaway is to hold less sensitive data and encrypt what you keep at rest. Gosch’s own recommendation list says it bluntly, that ransomware “is not looking at data in motion.” If your HR folder is a shared drive of scanned driver’s licenses from 2014, that folder is your ransom note waiting to be written. If a note is already on a screen, our first-hour ransomware response guide covers the first 60 minutes.

Whether to pay is its own decision with its own legal traps. We cover the payment question and the first 72 hours in ransomware recovery in Texas.

Lesson 3. What does cyber insurance actually pay for?

Less than owners assume. Judson carried what the testimony calls a sizable cyber policy, and it helped. The policy paid for attorneys, public relations, the threat actor hunt, data mining and notification letters, and it brought in the forensic firm BlueVoyant. If you want a plan like that in place before an incident, see our data breach response plan for Texas businesses.

But it didn’t cover the ransom payment. It didn’t cover upgrades to prevent a repeat. Both hurt.

That table describes one public school district’s policy as it stood in 2021, so treat it as an example of how coverage gets carved up rather than a prediction of what your own carrier will pay. Yours will differ, which is exactly the point. Pull the declarations page and read it before you need it. Today, ideally.

The part that surprised me more was the waiting. Because the district wanted to protect its insurance reimbursement, it was asked not to start recovery until the forensic review finished. It waited about 2 weeks, then started rebuilding on its own because school opened in under 30 days. The forensic work itself didn’t wrap up until June 13, 2022. If your policy requires a panel forensic firm, find out now whether you’re allowed to restore operations while they investigate, and who at your company has the authority to say go. Judson needed an emergency board vote in the first 24 hours to get that authority. Decide yours now.

We’ve written about answering the cyber insurance application honestly, and that matters here too. A policy you misrepresented on the application may not pay at all.

Lesson 4. What did the appraisal district and UTSA get right?

Both limited the blast radius. That’s the whole lesson, and it’s worth seeing twice.

When ransomware reached the Bexar County Appraisal District on a Sunday morning in March 2022, email and several systems went down and some files were damaged. But the appraisal records database was not accessed, the public website stayed up, the phones kept working, and the district restored from its own backups in an estimated 1 to 2 days. Assistant Chief Appraiser Scott Griscom said the attack appeared to arrive through email even though nobody seemed to have clicked a link. Staff notified the FBI immediately. Fast and boring.

UTSA is the newer story. Over a weekend in August 2026 the university detected unauthorized activity, took registration, payment and phone services offline on purpose, and pushed back the start of fall classes. Chief Technology Officer Michael Schnabel told reporters the threat was contained at the network edge before it reached core systems, with no evidence that university data was accessed or taken. Not confirmed as ransomware, for the record.

Two different organizations, one shared habit. Someone had decided in advance which systems could be sacrificed and which had to stay separate.

Pulling the plug on your own payments and phones during the busiest week of your year feels terrible, and every instinct in the building will argue for keeping things running a little longer. It’s still a far better week than Judson’s. A business owner should know, before anything happens, which systems they’d shut down first and whether their managed provider can do that at 2 in the morning without waiting for a callback. We keep a live San Antonio office on Radium Street and publish a 5-minute average first response for exactly that reason. Speed at hour 1 decides what hour 48 looks like.

Lesson 5. What happens when the systems nobody calls IT go down?

They go down with everything else. Uvalde CISD, about 80 miles west of San Antonio, closed every campus for a week in September 2025 after ransomware knocked out internet, phones, heating and air conditioning, security cameras and visitor management. Investigators found no data breach. Didn’t matter. The buildings still couldn’t open safely.

Judson lost building access control and cameras too. That’s a pattern.

Look around your own office. The door badge system, the camera recorder in the back closet, the phone system, the smart thermostat and the label printer on the warehouse floor are often sitting on the same flat network as the accounting PC. Nobody thinks of them as IT until they stop. Then everyone does. Uvalde’s phones were the last system restored, and if your business takes orders by phone that’s worth a long pause. Our San Antonio business phone service page explains how hosted VoIP keeps calls routing when the office network is down.

Segmenting those devices onto their own network is cheap compared with a week closed. Really cheap.

Lesson 6. Can a vendor’s breach take your business offline?

Yes, and May 2026 proved it locally. When the Canvas learning platform was attacked during finals week, UTSA, UIW, Alamo Colleges and SAISD all lost access to a system they didn’t run and couldn’t fix. ShinyHunters claimed the attack. Schools rescheduled exams. Students waited.

None of those schools did anything wrong inside their own networks, and there was nothing their IT teams could patch, restore or isolate that would have brought the platform back a minute sooner. Their vendor did.

Every San Antonio business has a Canvas equivalent. Your payroll provider, your practice management system, your ERP host, your email. Write down the 5 cloud services that would stop revenue within a day if they vanished, and next to each one write what you’d do instead. If the answer is “wait,” at least you’ll know that’s the plan. It’s a start.

What else is on the San Antonio record, and what never was ransomware

The table above holds the 5 incidents with the most published detail. Four more entries belong in the record, and two of them show how a plain outage turns into an attack headline. Every row below has a primary source or a reporter quoting a named official. Leak-site claims and the tracker sites that repeat them stay out, because an extortion group has every reason to pad its victim list.

People forget Rackspace. Its Form 8-K, dated December 6, 2022, reported “a ransomware incident affecting our Hosted Exchange environment.” A month later the company told TechTarget that the Play group was behind it and that the attackers had reached the stored mailbox files of 27 of its roughly 30,000 Hosted Exchange customers, with no evidence that any of those emails were viewed or misused. A San Antonio company, in an SEC filing, using the word ransomware. Hardly a rumor.

Alamo Heights ISD is the 2026 case most often called ransomware without proof. Leak-tracking sites list an extortion group’s claim, and the district hasn’t confirmed it, so it stays unconfirmed here. What the district did say, through spokeswoman Julie Ann Matonis, is that “personal information was accessed and potentially downloaded,” and the Express-News reported that its cyber insurer paid more than $36,000 to restore systems. The notice to the Attorney General dates the breach to March 4 and the discovery to May 18, while the outage itself was reported in late March. If those filing dates are right, someone sat inside for about 3 weeks before anything visibly broke.

Edgewood ISD shows how an outage becomes an attack online. In January 2024 a deputy superintendent described the district’s 2021 outage as an attack, and a district spokeswoman later said he’d misused the word, according to the San Antonio Report. Edgewood’s chief of staff also said some data may have been lost “due to a lapse in backup consistency procedures.” That’s Lesson 1 again, with no ransomware needed. Nobody has confirmed ransomware there, and the district’s separate August 2026 notice doesn’t name a cause either.

UTSA hasn’t called its August incident ransomware, and Texas Public Radio reported no attacker named. The Canvas problem three months earlier was a vendor failure. Instructure told KSAT that someone exploited an issue with its free-for-teacher accounts, and the Associated Press reported that ShinyHunters claimed the attack and demanded payment to stop further data leaks.

What the state’s breach list shows for San Antonio businesses

Ransomware is only one way onto the Texas Attorney General’s Data Security Breach Reports list. Still, it’s the closest thing Texas has to an official count of who got hit. I pulled all 651 notices posted from October 13, 2025 through October 12, 2026 and kept the ones filed by organizations based in the San Antonio area. That left 22 notices from 21 organizations. For scale, organizations based anywhere in Texas filed 273.

Healthcare filed nearly half. Five notices came from dental offices, and 4 of those were posted on the same day with the same May 25 start date and the same list of exposed data, 24,687 Texans between them. That usually points to one shared system or vendor rather than 4 separate break-ins, though the notices don’t say so. I’m inferring that.

One bank’s notice covered 191,848 Texans on its own, about 60% of the total. Its filing dates the breach to December 6, 2025 and the discovery to April 22, 2026, a gap of 137 days. That’s over 4 months. Social Security numbers were exposed in 13 of the 22 notices, and that’s the expensive kind. The median filer found its breach 26 days after it started, but 6 filers took between 117 and 397 days, which is months of exposure before anyone inside noticed.

Posting lag needs a caveat. Half the notices went up more than 38.5 days after the filer’s own discovery date, which looks slow until you read Business and Commerce Code section 521.053. A filer gets 30 days to notify the Attorney General, and the office gets another 30 to post it. Discovery dates are self-reported, too, and some filers enter the day they confirmed which data was involved, not the day they first noticed trouble.

Which San Antonio businesses the FBI data says get hit

The breach list can’t single out ransomware. FBI data can, roughly. The 2025 Internet Crime Report counted more than 1,400 ransomware complaints from organizations with no tie to a critical infrastructure sector, then broke them down by industry. Set that list next to Bexar County’s private employers in the Bureau of Labor Statistics Quarterly Census of Employment and Wages, using the 2025 annual averages, and it looks like this.

That’s 6,260 Bexar County establishments in the 5 industries the FBI names most, averaging 16 people each. Law and consulting offices average 7, and a 7-person office rarely has a security analyst or a patch schedule. One caveat on manufacturing. The county count covers every plant, including ones the FBI would file under critical manufacturing, so read that row as an upper bound, and probably a generous one.

Regulated work is where this gets expensive. If you run a law office, law firm cybersecurity in San Antonio covers what the Texas bar expects of you. Medical and dental practices filed the most notices on the state list, and HIPAA cybersecurity requirements for San Antonio practices lays out their side. Defense suppliers around Joint Base San Antonio carry a third layer, which is what our CMMC compliance work in San Antonio is built for.

How the attackers in this record got in

None of these groups picked San Antonio. They picked an opening. Rackspace’s attackers came in through Microsoft Exchange, and the Judson testimony says PYSA chose victims based on their ability to pay, so budgets mattered and geography didn’t.

CISA’s #StopRansomware advisory on the Play group, last revised June 4, 2025, lists the ProxyNotShell Exchange flaws among Play’s ways in, next to stolen valid accounts and older FortiOS bugs, and says the FBI knew of about 900 affected organizations as of May 2025. Play steals first, then encrypts. The Akira advisory, last revised November 13, 2025, says its operators “primarily target small- and medium-sized businesses” and get in through VPN products such as SonicWall, with stolen logins or the CVE-2024-40766 flaw. As of late September 2025 the group had claimed about $244.17 million in ransom proceeds. That’s not a niche operation.

So how does a 12-person firm off Loop 1604 end up in somebody’s queue? Usually by answering a scan. Affiliates sweep the internet for one appliance model and one firmware version at a time, then work down whatever responds. Nobody researched your company. Your firewall replied.

Nights and weekends keep showing up too. Judson’s first alarm came around 5 in the morning, the appraisal district was hit on a Sunday, and UTSA’s intruders arrived over a weekend. Nobody on an hourly break-fix plan is watching logins at those hours, which is a big part of why San Antonio businesses are leaving break-fix. Fixes follow the entry points, and the 7-layer ransomware protection playbook applies here unchanged.

How this record is kept

A line goes in a table only when the organization said it, a regulator published it, or a reporter quoted a named official saying it. Testimony to Congress counts, and so does an SEC filing. The Attorney General’s list has limits of its own. It only covers breaches involving 250 or more Texans, posting can take up to 30 days after a notice arrives, and the statute has each notice come down after a year unless the same organization reports another breach, which is why nothing from 2021 or 2022 shows up there now. I re-checked every link on this page on November 3, 2026, and re-ran the search for a City of San Antonio ransomware attack that day. I found nothing new.

The 6 lessons as a checklist for this month

Here’s the whole post as a working list. It’s sorted by what costs the least to fix. Start at the top.

What should a San Antonio business do in the first hour?

Judson’s team made the right early moves with no playbook, and Gosch wrote that the district’s formal continuity documents were “as useless as the paper that they were printed upon.” Plans that live in a binder fail. Plans people have rehearsed don’t. Rehearse yours.

Adapted from what Judson did and from the CISA #StopRansomware guide, here’s the order I’d follow. Print it.

1. Disconnect affected machines from the network, but leave them powered on so evidence survives.
2. Take Wi-Fi and remote access offline and change the passwords that control them.
3. Call your managed IT or incident response provider, then your cyber insurer, before anyone starts wiping or rebuilding.
4. Report it to the FBI through IC3 and keep the case number.
5. Check whether your offline backups are intact and write down when each was last taken.
6. Start a written timeline of who did what and when. Your lawyer and insurer will both ask.

Then there’s the Texas clock. If personal information of at least 250 Texans was involved, Business and Commerce Code section 521.053 requires notice to the Texas Attorney General within 30 days of determining the breach occurred, and affected people must be notified within 60. Judson’s breach touched 428,761 people, 221,000 of them outside Texas, so the notification job alone ran for months. Calendar it early.

Want the prevention side in more depth? Our step by step ransomware prevention plan covers the controls, and the FBI industry breakdown above shows which local industries attackers pick first.

Where a managed security provider fits

I’ll be straightforward about my bias. We sell managed security, so of course I think it helps. Weigh that. But if you already have a staffed internal security team that tests restores quarterly and watches alerts overnight, you probably don’t need us for this. Most San Antonio companies with 20 to 200 employees don’t have that team, and that’s the gap Judson described, a small technology staff asked to watch more data than one person can. It’s common.

What a provider should bring is the dull stuff done on schedule. Endpoint detection on every device, not just servers. Restore tests with a report. Alerts watched at night. Segmented networks. A named person who picks up at 2 in the morning. That’s the job. If you’re comparing options, our managed security services in San Antonio page lists what’s included, and San Antonio cybersecurity pricing shows what it costs.

Questions San Antonio owners ask about these attacks

Has the City of San Antonio ever been hit by ransomware?

How much did Judson ISD pay in the ransomware attack?

Do small businesses in San Antonio really get targeted?

Will my cyber insurance pay the ransom?

Is paying the ransom illegal in Texas?

What’s the single cheapest fix after reading all this?

Was Alamo Heights ISD hit by ransomware?

Did the 2022 Rackspace ransomware attack happen in San Antonio?

How can I check whether a San Antonio business reported a data breach?

Are San Antonio businesses attacked more than other Texas cities?