Minneapolis Public Schools cyberattack: What to know and how to protect your data

Minneapolis Public Schools suffered a cyberattack last month that temporarily disabled some district technology and led to a data breach that appears to have revealed some personal information online this week. But details of what happened are still scarce.

Here's what we know — and don't know — about the breach and what you can do to protect yourself or your child if you are affected.

MPS has described the incident as an "encryption event" by a "threat actor."

The district issued a news release Feb. 21 saying it "recently began experiencing technical difficulties affecting the operability of certain computer systems." Students were not in school buildings Feb. 22-24 because of a snowstorm, and the district said the technical issues would not affect e-learning activities.

In an update Feb. 24, the district began referring to the tech troubles as an "encryption event" and encouraged people to change passwords for personal accounts that may have been accessed on district devices, saying that was "a best practice and out of an abundance of caution." At that time, the district said it had "no evidence that personal information was compromised as a result of this event."

On March 1, the district said it still had "not found any evidence that any data accessed has been used to commit fraud" but was working with law enforcement, outside forensic investigators and legal counsel. It warned people to be wary of possible phishing attempts and scams and monitor financial accounts.

The district notified families Tuesday that a "threat actor" claimed responsibility for the "encryption event" and "apparently posted online some of the data they accessed from MPS." That was reported to law enforcement and the district said it was working to have the online information removed. It again said families should be cautious about potential scams and recommended changing passwords.

On Thursday, the district said it was reviewing the data that may have been accessed and said, "This will take some time and individuals will be contacted directly by MPS if this review indicates personal information has been impacted."

District officials have declined several requests for interviews and declined to answer questions that would explain further.

A ransomware group called Medusa has claimed responsibility, without specifying motive, and demanded $1 million to delete the data, according to news sites that cover cybersecurity.

It is still unclear what, exactly, was accessed. The district has declined to say.

A 51-minute video posted online — but since removed — showed screenshots of a wide variety of information, including spreadsheets that appeared to list student names and addresses, disciplinary information and forms that could contain sensitive employee information, like W-2s. Other images appear to show lesson plans, enrollment projections and district forms and policy documents.

The district said March 1 that it had not paid any ransom.

In earlier communications about the "encryption event," the district said it has worked with third-party IT contractors to investigate, monitor and restore its systems. Some of those efforts include "advanced endpoint detection" tools that the district likened to a virus alert system, updated passwords and additional multifactor authentication.

The district said Thursday that people "whose legally protected personal information has been accessed will be provided with free credit monitoring and identity protection services."

Online security experts have said school districts have increasingly become targets of these kinds of cyberattacks.

Minneapolis Public Schools has said the issues have been reported to law enforcement, but they have not said which agencies.

A spokesperson declined to say anything more about third-party investigators or contractors involved in investigations.

There are several steps you can take to prevent criminals from using your personal information.

You can find more information on how to prevent identity theft at usa.gov/identity-theft. This Federal Trade Commission website offers information specifically about protecting children from identity theft.

You can create an account and report the theft to the Federal Trade Commission at identitytheft.gov and follow the steps to create a recovery plan.