Mastery Charter High School cyber attack exposed personal data of over 35,000 individuals

Philadelphia-based Mastery Charter High School said it suffered a significant cyber attack that compromised the sensitive personal information of more than 35,000 individuals.

 

Mastery Schools is one of the largest charter school networks in Philadelphia. With 23 schools in Philadelphia and Camden, it operates 14 elementary schools, two middle schools, and seven high schools.

 

In a data security incident notice filed with the Office of Maine Attorney General, Mastery Schools said that on September 15, it detected malicious encryption that affected its internal network. The institution immediately launched an investigation, with assistance from external cyber security experts, to determine the scope of the incident.

 

It also took steps to contain, and remediate the situation, including proactively shutting down the affected systems and notified relevant law enforcement authorities about the same.

 

“Our investigation determined that an unauthorised actor downloaded some of our data, which may have included your information,” Mastery Schools said.

 

The compromised data included names, dates of birth, Social Security Numbers, taxpayer ID numbers, driver’s license/government-issued IDs, passport numbers, financial information, biometrics, usernames and passwords, medical and treatment information, health insurance information, student IDs, and more.

 

The filing with the Maine state regulator also states that Mastery Schools has identified at least 37,031 individuals impacted by the incident.

 

While the school authorities found no evidence of the compromised information being misused, it advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and the state attorney general.

 

It has also offered one year of complimentary identity protection and credit monitoring services through Experian IdentityWorks to all affected individuals.

 

 

In October, the DragonForce ransomware group claimed responsibility for the cyber attack on Mastery Schools and listed it as a victim on its data leak site. The group claimed to have exfiltrated 171 GB of data and threatened to release it publicly unless their ransom demands were met.