In March, 2021, Broward County Public Schools disclosed a breach that captured the public’s attention when Conti threat actors subsequently released a copy of their negotiation chat logs. When negotiations failed to result in an agreement, the threat actors dumped nearly 26,000 files on their dark web and clearnet leak sites.
Now, seven months after Conti dumped the 26,000 files, Broward County Public Schools has issued a press release that acknowledges that the files accessed by the threat actors “may have potentially included the sensitive information of some faculty, staff, and students.”
Through an investigation, it was determined that an unauthorized person obtained access to BCPS systems between November 12, 2020, and March 6, 2021. On April 19, 2021, the investigation revealed certain records stored on the District’s systems had been acquired and publicly released. On June 8, 2021, it was determined that the records released by the cyber criminals included information that included individuals’ names and Social Security numbers. On June 29, 2021, further analysis indicated that the data accessed may include information relating to our self-insured health plan, including individuals’ names, dates of birth, Social Security numbers, and benefits selection information.
The District is now providing written notification to the affected individuals. In an abundance of caution, BCPS is also posting this notice to inform the public (including all those who did not receive a written notification from the District) about the extent of this incident and provide recommendations on ways to protect personal information. The District is also offering complimentary credit monitoring, by request, to those affected.
A full copy of the district’s notice can be found on their website. The notice does not indicate the total number of individuals impacted, nor the number who had protected health information impacted. This incident does not appear on HHS’s public breach tool at the time of this publication.