Cyber attack on Alamo Heights ISD exposes data for 26,000 people

A cyber attack disrupted operations at Alamo Heights Independent School District in March and compromised the personal information of approximately 26,000 people, including Social Security numbers, driver’s license numbers and financial or medical records, the Texas Attorney General’s Office disclosed Monday.

The attack left staff and students without internet access for nearly a week. School officials launched a forensic investigation following the incident and discovered that personal information had been accessed and potentially downloaded, AHISD spokeswoman Julie Ann Matonis said in a statement Tuesday. "We promptly notified impacted individuals in accordance with relevant breach notification requirements," she added. The district has since restored normal day-to-day operations.

The district notified affected people by U.S. mail. According to records obtained through public disclosure, cyber insurance covered more than $36,000 in system restoration costs.

Texas law requires government agencies to report security breaches affecting 250 or more state residents to the attorney general within 30 days of discovery. AHISD filed its report Monday, meeting the legal deadline.

The breach is part of a broader pattern of ransomware attacks targeting Texas school districts. Judson ISD paid hackers more than $500,000 in 2021 following a month-long attack that disabled the district’s phones, computers and email systems. Uvalde Consolidated Independent School District canceled classes for several days in September after a similar attack.

In response to escalating threats, the Texas Education Agency established a K-12 Cybersecurity Initiative in 2023 to help districts defend against ransomware and phishing attacks. State lawmakers approved $42 million in additional funding to extend the program through 2027. The legislation built on Senate Bill 820, passed in 2019, which mandated that all districts adopt cybersecurity policies, designate a cybersecurity coordinator and establish breach reporting procedures to the education agency.