Lake Dallas Independent School District

Summary

A ransomware group known as Royal claimed responsibility for an attack on a Texas independent school district, alleging they had stolen gigabytes of sensitive personal information including hundreds of Social Security numbers and passport details. The threat actors added the victim to their leak site and threatened to publish the data, though no files were actually released as proof and none had been leaked by early the following month. The district subsequently submitted a breach notification to the Texas Attorney General's Office, reporting that more than twenty-one thousand state residents were affected. The compromised data was extensive, encompassing names, addresses, Social Security numbers, driver's license and government ID numbers, financial account information, medical records, and health insurance details, with affected individuals being notified by U.S. mail.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

In April 2023, the Lake Dallas Independent School District in Texas was added to the leak site operated by the Royal ransomware gang, marking a public claim of responsibility for a cyberattack against the district. The attackers accompanied their listing with a derogatory message describing the district as vibrant and progressive while criticizing what they characterized as inadequate cybersecurity practices. The Royal gang claimed to have exfiltrated hundreds of Social Security numbers along with "an array of passport information" belonging to both students and staff, and they threatened to publish the stolen material. Despite the threatening tone of the post, no proof-of-claim data samples or evidence of the alleged theft were posted at the time the listing appeared, and as of May 4, no data from the district had been published on the gang's leak site.

Following the appearance of the district on the Royal ransomware leak site, Lake Dallas Independent School District proceeded to notify relevant authorities and affected individuals about the breach. On April 18, 2023, a notice of the incident was submitted to the Texas Attorney General's Office indicating that 21,982 Texas residents had been impacted. Notification to those affected individuals was carried out through the United States Postal Service in the form of mailed letters. The information reported to the Texas Attorney General as having been involved in the breach included a broad range of sensitive personal data categories: names of individuals, physical addresses, Social Security numbers, driver's license numbers, government-issued identification numbers such as passports and state identification cards, financial information including account numbers and credit or debit card numbers, medical information, and health insurance information.

Although the district filed the notification with the Texas Attorney General's Office, several details about the incident remained unclear from public sources. The submission did not explicitly identify the event as a ransomware attack or attribute the intrusion to the Royal ransomware gang, leaving the connection between the leak site listing and the official notification based on inference from the timing and circumstances. Additionally, the publicly available documentation did not specify whether the 21,982 affected individuals were exclusively employees, a combination of employees and students, or some other grouping of people associated with the district. The Texas Attorney General's Office does not publish the actual notification templates sent to victims, so the precise wording that affected individuals received in the mail could not be independently verified from the available sources. No notice about the breach was visible on the district's website home page at the time of reporting, raising further questions about the public communication strategy employed by Lake Dallas Independent School District in response to the incident.

The chronology of the incident, as established from the available evidence, indicates that the threat actors gained access to the district's network and exfiltrated sensitive personal information prior to or during April 2023. The Royal ransomware gang then publicly listed the district on their leak site, claiming possession of gigabytes of student and staff personal information. After the appearance on the leak site and the absence of any immediate data publication, the district submitted a breach notification to the Texas Attorney General's Office disclosing the scope of the impact as 21,982 Texas residents and detailing the categories of compromised information. Notification letters were subsequently sent to affected individuals via U.S. mail as part of the response process. The Royal gang did not release any of the alleged stolen data through May 4, leaving the ultimate fate of the exfiltrated information and any subsequent ransom demands or negotiations undisclosed in the available reporting.

Sources

Sources available to members: 1 source.