Delano Public Schools cancelled classes for a day in May 2026 following a ransomware attack on district systems. In June, LockBit claimed responsibility.
The Gap Is The Negotiation
A month between attack and public claim is not an oversight. Leak-site publication is the pressure mechanism, and it is held back while a negotiation is live.
When a claim appears publicly, it usually indicates the negotiation has failed, stalled, or was never entered. The claim is not an announcement — it is the next step in the extortion.
Which Makes The Public Timeline Misleading
Anyone tracking incidents from leak-site listings, as a good deal of threat intelligence does, is observing negotiation failures rather than attacks. Victims who pay quietly never appear.
That is a systematic bias in the data this desk and everyone else works from, and it runs in a specific direction: the visible population over-represents organisations that refused or could not pay, which skews toward the underfunded.
One Day Of Cancelled Classes
The operational impact here was smaller than the Evanston closure filed at 26-0607b — a single day rather than two, with no reported cancellation of wider programmes.
Graded medium: the closure and the subsequent claim are consistently reported; the access route, the data scope and whether any payment was discussed are not established.
Compiled from public reporting, listed below. The attribution is a group claim rather than an independent finding, and we treat it as such. Corrections: corrections@forensicpost.com.