Minneapolis Public Schools sent an email to families Friday saying the district has begun contacting people who may have had their personal information accessed in the February cyberattack on the district.
"Notification letters should arrive at homes within the next two weeks," the email read.
The district became aware of what it first called an "encryption event" on Feb. 18 when computer systems were down. An investigation showed that a hacker had accessed information in the systems between Feb. 6 and Feb. 18.
In March, a ransomware group claimed responsibility for the attack on Minneapolis Public Schools and posted a $1 million ransom, along with a 51-minute video — since removed — with screenshots showing a wide variety of information. The data it displayed included student names and addresses and forms that could contain sensitive employee information.
"Understanding what information had been impacted was critical," the Friday email to families said. The district partnered with national specialists to do a "comprehensive review" of the computer systems involved to determine what sensitive information was accessed and identify those who were impacted.
"This process was time-intensive and required both computer-assisted and manual review," the email read. "Although it has been difficult to not share more information with you sooner, the accuracy and the integrity of the review were essential."
The district is offering free credit monitoring to people who were affected by the data breach and has connected others to a service to address "mental or emotional responses to this incident," according to the email.
District policies and procedures are undergoing review, protections have been added and staff is receiving additional training to help prevent other cyber security issues, the statement said.
