Minneapolis Public Schools notifies over 100,000 individuals of data breach after cyberattack

Minneapolis Public Schools (MPS) has informed more than 100,000 individuals that their personal data may have been compromised following a cyberattack earlier this year.

The attack, attributed to the Medusa ransomware group, occurred on March 7, 2023. The perpetrators demanded a hefty ransom of $1 million to decrypt MPS systems. Despite the ransom demand, MPS chose not to pay, and the consequences were dire.

The cybercriminals responsible for the attack made their intentions clear by leaking data just ten days after the initial breach, including highly sensitive student files. Additionally, they released a 51-minute video showcasing screenshots of the stolen information.

In the official notification letter to affected individuals, MPS explained that it had not been able to inform victims earlier due to the necessity of conducting a "comprehensive review" to determine the extent of sensitive information compromised during the breach. This review, which involved computer-assisted and manual processes, concluded on July 24, 2023. MPS stressed the importance of maintaining the accuracy and integrity of this review as the reason for the delay.

Reports from early July by the Associated Press revealed the frustration of students and families with the district’s lack of formal notification. Families had contacted administrators regarding various fraud and other abuses from the data breach.

Late last week, MPS initiated sending notification letters to those affected, as reported by local media. On Tuesday, Maine’s data breach notification site disclosed that the breach had impacted 105,617 individuals.

MPS is now taking steps to mitigate the damage caused by the breach, offering 24 months of credit monitoring and identity theft restoration services to affected parties. A dedicated phone line has also been established to assist victims in addressing their concerns.