Mastery Schools Alerts 37,031 Individuals of Significant Data Breach

A ransomware attack has resulted in the compromise of personal data belonging to 37,031 individuals, as confirmed by Mastery Schools, the largest charter school network in Philadelphia. The incident, which occurred in September 2024, exposed sensitive information including Social Security numbers, medical details, and student records.

Mastery Schools initiated notifications to affected individuals over the weekend. The cyber attack was detected on September 15, 2024, when an unauthorized actor encrypted critical systems, disrupting essential operations including phone and email access. The ransomware group involved, DragonForce, has claimed responsibility, stating it stole 171 GB of data from the school and has since listed Mastery Schools on its leak site. However, Mastery has not yet verified the claim, nor disclosed details regarding how the attackers gained access or if a ransom was paid.

In its notification, Mastery reported that an unauthorized actor had downloaded some of its data and indicated that there is currently no evidence linking the breach to identity theft or fraud.

The compromised data reportedly includes:

– Names
– Dates of birth
– Social Security numbers
– Taxpayer ID numbers
– Government-issued IDs
– Passport numbers
– Bank and financial information
– Credit and debit card details
– Biometric data
– Usernames and passwords
– Medical and health insurance information
– Student ID numbers
– Student records

To support the individuals affected, Mastery is offering free identity protection services through Experian’s IdentityWorks, with enrollment required by August 31, 2025. CEO Dr. Joel Boyd stated that the organization will enhance its security protocols by increasing its use of multi-factor authentication and improving endpoint monitoring.

Furthermore, Mastery Schools has engaged external cybersecurity professionals and is collaborating with federal law enforcement agencies to investigate the breach and mitigate the risk of future incidents.

A report by Comparitech reveals a worrying trend, with 79 ransomware attacks targeting educational institutions in the U.S. in 2024, affecting approximately 2.9 million records. Recent attacks have also impacted school districts across Texas, Georgia, Virginia, and New Jersey, often causing significant operational disruptions such as delays in testing and payroll issues.

Mastery Schools operates 23 campuses across Philadelphia and Camden, serving around 14,000 students, encompassing elementary, middle, and high schools.