Thousands of Baltimore students, teachers affected by data breach following February ransomware attack

Thousands of students, teachers and administrators had information stolen from the Baltimore City Public Schools system during a ransomware attack in February.

Officials at Baltimore City Public Schools published a breach notice on Tuesday warning that a cyber incident on February 13 exposed certain IT systems within the network. 

The statement said an investigation revealed that “certain documents may have been compromised by criminal actors, which contained information belonging to some current and former employees, volunteers, and contractors, as well as files related to less than 1.5% of our student population.”

A Baltimore City Public Schools official confirmed to Recorded Future News that the incident was a ransomware attack but said no ransom was paid. 

They did not say how many people were affected but the letters explain that 1.5% of the current Baltimore City Public Schools student population was impacted — which would put the figure at more than 1,150 students.

In an FAQ document attached to the online breach notice, the city said the hackers may have obtained the folders, files or records “belonging to certain current and former employees who completed the I-9 verification process as part of their onboarding to City Schools, as well as certain employees, volunteers, and contractors who have undergone a background check with City Schools.”

The files likely contained Social Security numbers, driver’s license numbers or passport numbers. For the students impacted, the hackers acquired files with student call logs,  absenteeism records or maternity status.

The Baltimore Banner reported that school system CEO Sonja Santelises, who herself was impacted by the breach, said 55% of the school’s employees were affected. 

11 News/WBALTV added that it allegedly found a ransom note connected to the incident from the Cloak ransomware gang. The local news outlet said school officials told them a total of about 25,000 people were affected by the breach, including more than 7,000 current teachers and “anyone who has ever been employed by the district since 2010.”

Law enforcement was contacted about the incident and cybersecurity firms were hired to help the school system recover from the attack. 

No hacking group or ransomware gang has taken credit for the attack as of Tuesday afternoon. The letter says that “due to City Schools’ aggressive response to the cybersecurity incident, while some individual files were acquired, there is no indication that the actions of the criminal actors significantly disturbed schools or other functions.”

The city began sending out breach notification letters on Tuesday to those who may have been affected by the breach. Victims are being offered two years of credit monitoring services and a call center will be set up to answer questions about the incident. 

“We completed our investigation yesterday and notified those impacted and the community today. Since the incident, we have implemented a series of additional cybersecurity enhancements, including installing endpoint detection and response software and resetting all users’ passwords,” the school spokesperson told Recorded Future News. 

Baltimore County Public Schools suffered a cyberattack in 2020 which cost the city more than $10 million in network upgrades and damages. The city government was also hit with a wide-ranging ransomware attack in 2019. 

Cybersecurity experts have tracked at least 75 ransomware attacks on K-12 schools and colleges so far in 2025, one of the highest figures seen since researchers began tracking the numbers.

Correction: An earlier version of this story mistakenly said Baltimore City Public Schools suffered a cyberattack in 2020 — that incident affected Baltimore County Public Schools.