Ransomware attack exposes records of hundreds of thousands of students and staff in Chicago

A data breach in Chicago Public Schools has compromised personal information of nearly 500,000 students and more than 56,000 employees.

The Chicago Tribune reports that the affected data included name, date of birth, gender, grade level, school and district and state student ID numbers, as well as information about courses students took and scores on tasks used to evaluate teachers during from 2015 to 2019.

The staff records to which an unauthorized party gained access included name, school employee ID number and district email address, the district said.

“There were no Social Security numbers, no financial information, no health data, no current course or schedule information, no home addresses, and no course grades, standardized test scores, or teacher evaluation scores exposed in this incident," the district said.

The breach resulted from a ransomware attack on one of the district's technology vendors, Battelle for Kids. It occurred on a server used to store student and staff information.

The breach occurred on Dec. 1, 2021, the district said, but it was not notified by Battelle for Kids until April 26.

The district says it has a $90,000 contract with Battelle and that the organization “stores student course information and assessment data for the purposes of teacher evaluations.”