San Antonio Ransomware Attacks: A Dated Record, 2021-2026

What those attacks teach a business owner is a separate question. Our breakdown of San Antonio ransomware attack lessons covers it. This page is the record.

Has the City of San Antonio been hit by ransomware?

No. Not on any public record.

Start with the hardest evidence, the Texas Attorney General’s breach list. State law requires a notice there within 30 days whenever sensitive data on 250 or more Texans is exposed, and cities and counties file like everyone else. In the 12 months to October 12, 2026, 19 Texas government bodies filed notices there, from county offices in Bell, Kaufman, and Nacogdoches to the City of Mission and two from the City of Houston. City Hall isn’t listed. Neither is Bexar County.

A notice wouldn’t prove ransomware anyway. Each listing records what data was exposed and how many Texans were affected. It never says how the attacker got in.

Local news agrees. Coverage turns up attacks on schools, a university, the county appraisal office, and a Windcrest tech company. Nothing on city systems. Not one report.

So why does the question keep coming up? Two incidents in 2026 carried San Antonio addresses, Alamo Heights ISD in March and UTSA in August, and both made local news. Dallas had a real City Hall attack in 2023, which we covered in ransomware protection in Dallas. Stack those up and a San Antonio city attack starts to sound familiar. No record shows one.

San Antonio area ransomware and cyber incidents, dated

Every row below has a primary source, or a news report that quotes a named official. Leak-site claims don’t count. Neither do the tracker sites that repeat them.

Watch the status column. Four incidents are on record as ransomware. The rest weren’t confirmed, or haven’t been yet.

People forget Rackspace. Its Form 8-K, dated December 6, 2022, reported “a ransomware incident affecting our Hosted Exchange environment,” a business the company said brought in about $30 million a year. A month later Rackspace told TechTarget that the Play group was behind it and that the attackers had reached the stored mailbox files of 27 of its roughly 30,000 Hosted Exchange customers, with no evidence that any of those emails were viewed or misused. A San Antonio company, in an SEC filing, using the word ransomware. Hardly a rumor.

Alamo Heights ISD is the 2026 case most often called ransomware without proof. Leak-tracking sites list an extortion group’s claim, and the district hasn’t confirmed it. So it stays unconfirmed here. What the district did say, through spokeswoman Julie Ann Matonis, is that “personal information was accessed and potentially downloaded,” and the Express-News reported that its cyber insurer paid more than $36,000 to restore systems. Its notice to the Attorney General dates the breach to March 4 and the discovery to May 18, while the outage itself was reported in late March. If those filing dates are right, someone was inside for about 3 weeks before anything visibly broke.

Edgewood ISD shows how an outage turns into an “attack” online. In January 2024 a deputy superintendent described the district’s 2021 outage as an attack, and a district spokeswoman later said he’d misused the word, according to the San Antonio Report’s January 18 story. Edgewood’s chief of staff also said some data may have been lost “due to a lapse in backup consistency procedures.” Nobody has confirmed ransomware there. And the district’s separate August 2026 notice on the state list, covering 3,000 Texans, doesn’t name a cause either.

UTSA hasn’t called its August incident ransomware. University officials said they found unauthorized activity targeting the university’s systems over a weekend, took some services offline, and moved the first day of fall classes from August 19 to August 24. No attacker named. Canvas, 3 months earlier, was a vendor problem. Instructure told KSAT that someone exploited an issue with its free-for-teacher accounts, and the Associated Press reported that ShinyHunters claimed the attack and demanded payment to stop further data leaks.

What the state’s breach list shows for San Antonio businesses

Ransomware is only one way onto the Attorney General’s list. Still, it’s the closest thing Texas has to an official count of who got hit.

We pulled all 651 notices posted to the Data Security Breach Reports list from October 13, 2025 through October 12, 2026 and kept the ones filed by organizations based in the San Antonio area. That left 22 notices from 21 organizations. For scale, organizations based anywhere in Texas filed 273.

Healthcare filed nearly half. Five notices came from dental offices, and 4 of those were posted on the same day with the same May 25 start date and the same list of exposed data, 24,687 Texans between them. That usually points to one shared system or vendor rather than 4 separate break-ins, though the notices themselves don’t say so. We’re inferring that.

One bank’s notice covered 191,848 Texans on its own. Call it 60% of the total. Its filing dates the breach to December 6, 2025 and the discovery to April 22, 2026, a gap of 137 days. Over 4 months.

Three law offices made the list too, none of them reporting more than 2,700 Texans. Legal services also lead the FBI’s ransomware complaints outside critical infrastructure, at 18%.

Two numbers stand out. Social Security numbers were exposed in 13 of the 22 notices. That’s the expensive kind. And while the median filer found its breach 26 days after it started, 6 filers took between 117 and 397 days, which is months of exposure before anyone on the inside noticed a thing.

Posting lag needs a caveat. Half the notices went up more than 38.5 days after the filer’s own discovery date, which looks slow until you read Business and Commerce Code section 521.053. A filer gets 30 days to notify the Attorney General, and the office gets another 30 to post it. Discovery dates are self-reported, too. Some filers enter the day they confirmed which data was involved, not the day they first noticed trouble.

Which San Antonio businesses the FBI data says get hit

The breach list can’t single out ransomware. FBI data can, roughly. Its 2025 Internet Crime Report counted more than 1,400 ransomware complaints from organizations with no tie to a critical infrastructure sector, then broke them down by industry.

Set that list next to Bexar County’s private employers in the Bureau of Labor Statistics Quarterly Census of Employment and Wages, using the 2025 annual averages, and it looks like this.

That’s 6,260 Bexar County establishments in the 5 industries the FBI names most, averaging 16 people each. Law and consulting offices average 7. A 7-person office rarely has a security analyst. Or a patch schedule.

One caveat on manufacturing. The county’s manufacturing count covers every plant, including ones the FBI would file under critical manufacturing, so read that row as an upper bound. Probably a generous one.

Regulated work is where this gets expensive. If you run a law office, law firm cybersecurity in San Antonio covers what the Texas bar expects of you. Medical and dental practices filed the most notices on the state list, and HIPAA cybersecurity requirements for San Antonio practices lays out their side. Defense suppliers around Joint Base San Antonio carry a third layer, which is what our CMMC compliance work in San Antonio is built for.

How the attackers in this record got in

None of these groups picked San Antonio. They picked an opening.

Rackspace’s attackers came in through Microsoft Exchange. CISA’s #StopRansomware advisory on the Play group, last revised June 4, 2025, lists the ProxyNotShell Exchange flaws among Play’s ways in, next to stolen valid accounts and older FortiOS bugs, and says the FBI knew of about 900 affected organizations as of May 2025. Play steals first, then encrypts. Double extortion.

Akira is the group to know if you run a small office. CISA’s Akira advisory, last revised November 13, 2025, says its operators “primarily target small- and medium-sized businesses” and get in through VPN products such as SonicWall, with stolen logins or the CVE-2024-40766 flaw. As of late September 2025 the group had claimed about $244.17 million in ransom proceeds. Not a niche operation.

Judson’s attackers worked from a different list. The district’s testimony says PYSA chose its victims “based on their ability to pay,” so budgets mattered and geography didn’t.

So how does a 12-person firm off Loop 1604 end up in somebody’s queue? Usually by answering a scan. Affiliates sweep the internet for one appliance model and one firmware version at a time, then work down the list of whatever responds. Nobody researched your company. Your firewall replied.

Nights and weekends keep showing up in this record. Judson’s first alarm came around 5 in the morning, the appraisal district was hit on a Sunday, and UTSA’s intruders arrived over a weekend. Not office hours. Nobody on an hourly break-fix plan is watching logins at those hours, which is a big part of why San Antonio businesses are leaving break-fix.

Fixes follow the entry points, and they’re written up separately. The 7-layer ransomware protection playbook applies here unchanged, ransomware recovery in Texas covers the first 72 hours if it’s already happening, and a data breach response plan for Texas businesses keeps you inside that 30-day Attorney General clock. Budget usually comes next. What cybersecurity services cost in San Antonio puts local numbers on it, and our list of the best cybersecurity companies in San Antonio compares the providers.

How this record is kept

A line goes in the table only when the organization said it, a regulator published it, or a reporter quoted a named official saying it. Testimony to Congress counts. So does an SEC filing.

Plenty stays out. Leak-site posts, the trackers that copy them, and screenshots on social media don’t make the table, because an extortion group has every reason to exaggerate or invent its victim list. Claims cost them nothing.

The Attorney General’s list has limits of its own. It only covers breaches involving 250 or more Texans. Smaller ones aren’t listed. Posting can take up to 30 days after a notice arrives. And the statute has each notice come down after a year unless the same organization reports another breach, which is why nothing from 2021 or 2022 shows up there now.

What people ask about San Antonio ransomware news

Was Alamo Heights ISD hit by ransomware?

Did the 2022 Rackspace ransomware attack happen in San Antonio?

Was the UTSA breach ransomware?

How can I check whether a San Antonio business reported a data breach?

Are San Antonio businesses attacked more than other Texas cities?

Has Bexar County government had a ransomware attack?