Sign up for Chalkbeat Chicago’s free daily newsletter to keep up with the latest news on Chicago Public Schools.
In a ransomware attack last year, Russian hackers stole private information for more than 700,000 current and former Chicago Public Schools students and put it on the dark web, district officials said Friday.
According to the district, the hackers gained access to a server where a CPS technology vendor stores student data. Using a weakness in the vendor’s software that CPS uses to share data with other agencies, the hackers stole information from the district and more than 60 other organizations across the country.
Students’ names, dates of birth, genders, and Chicago Public Schools student ID numbers were stolen.
“While we are still investigating this incident, we believe that all current students, and all former students dating back to the 2017-2018 school year were impacted,” the district said in a statement.
For roughly half of the impacted students, or about 344,000 current and former students, Medicaid ID numbers and dates of program eligibility were included in the data breach.
The stolen student information was originally encrypted, which the district likened to the hackers stealing a locked briefcase but without the key. However, district officials confirmed Friday that the hackers were able to break that encryption, exposing students’ private information.
The dark web is a part of the internet inaccessible with search engines, where illegal activity often takes place. The district said it would write to families Friday afternoon to inform them about the breach.
The district said it was never contacted about paying ransom in return for the stolen data. A growing number of school districts in recent years have been victims of such data ransomware attacks, which have at times exposed sensitive student and employee information. Technology news site TechCrunch reported that the Russia-linked ransomware gang Clop stole the data from CPS and almost 60 other organizations, taking advantage of a bug in software tools from tech company Cleo.
The district said Friday it worked with the FBI, the Department of Homeland Security, the State of Illinois Department of Innovation and Technology and other agencies to investigate the incident. Officials stressed that the stolen data did not contain Social Security numbers or financial information.
The district said it does not have any evidence that any of the stolen information has been misused. More information and resources for families are at cps.edu/databreach.
Mila Koumpilova is Chalkbeat Chicago’s senior reporter covering Chicago Public Schools. Contact Mila at mkoumpilova@chalkbeat.org.
