Baltimore City Public Schools hit with data breach

The Baltimore City Public Schools have experienced a ‘cybersecurity incident’, which has affected over 31,000 people.

The incident occurred on February 13, 2025, but has only recently been made public. An attacker managed to get access to a number of IT systems and exfiltrated an unknown quantity of documents containing information about current and former employees, volunteers, and contractors, as well as files related to less than 1.5% of the schools’ students.

Forensic research has shown that the documents may have contained personal information such as student data, call logs, absenteeism records, maternity status, social security numbers, driver’s license numbers, or passport numbers.

After the incident came to light, the Public Schools implemented additional cybersecurity safeguards, including the installation of endpoint detection and response software and the resetting of all passwords.

In a public announcement, the schools said they would continue “to assess our procedures already in place and the results of the forensic audit for ways to defend against evolving threats.” In addition, there’s no indication that the data breach has disturbed schools significantly in any way.

The Baltimore City Public Schools started sending notification letters to those involved on April 22. Furthermore, victims are offered credit monitoring services to help mitigate any potential harm. Lastly, a help desk has been established to answer any questions related to the incident.

The City Schools encourage affected individuals to remain vigilant for any type of fraud and to take steps to avoid identity theft and protect personal information.

Although the City Schools don’t mention the number of people that may have been affected by the data breach, the Maryland Office of the Attorney General confirmed to The Baltimore Sun that the breach impacted over 31,000 individuals.

Who’s responsible for the data breach at the Baltimore City Public Schools remains unclear at this moment. WBALTV, a local television station in Baltimore, claims that the incident is linked to the Cloak ransomware operation.