Medusa group publishes data stolen from Minneapolis Public School after ransom deadline expires

Threat actors have published on the dark web data they stole from Minneapolis Public School after the school district refused to pay a ransom.

Minneapolis Public School said in an official notice on its website that on February 21, it suffered an “encryption event” that affected internal IT systems and disrupted several systems including its internet, phones, cameras, badge access, printers, building alarms, and more.

On March 7, the infamous Medusa ransomware group listed Minneapolis Public Schools as its latest victim on its data leak site. The group said it gave the school district a deadline of March 17 to pay a ransom of $1 million in exchange for deleting all data or $50,000 to extend the deadline by another day. The group also said that it was willing to sell all stolen data to anyone willing to pay a million dollars.

Once the deadline was over, on March 17, the Medusa ransomware group published the data stolen from MPS. Ian Coldwater, a cybersecurity expert and an MPS parent, said that the leaked data includes current and former student records, parent contacts, home addresses, IDs with pictures, grades, sensitive disciplinary and health records, budgets, contracts, grant information, building layouts, payroll and human resources information, and more.

Acknowledging the data leak, MPS said that it is “aware that the threat actor has released certain MPS data on the dark web today, a part of the internet accessible only with special software that allows users to remain untraceable.

“We are working with cybersecurity specialists to quickly and securely download the data so that we can conduct an in-depth and comprehensive review to determine the full scope of what personal information was impacted and to whom the information relates. This will take some time.

“You will be contacted directly by MPS if our review indicates that your personal information has been impacted,” the school district said.

MPS added that its review was concluded on March 7 and it will contact affected individuals via email and mailed letters. The school district is also offering free credit monitoring and identity protection services to all affected individuals through Experian.

“MPS has taken a stance against these criminals and has fully restored our systems without the need to cooperate with the criminal. As our response continues, we continue to work with and align with the best practices provided by federal law enforcement,” MPS added.