Cyber Incident Victim: Stonington Public Schools
Date:
Sep 2021
Location:
United States of America
Summary
Stonington Public Schools experienced a ransomware attack compromising two file servers containing historical employee records, including names, dates of birth, contact details, Social Security numbers, health insurance identifiers, and tax-related information for 1,765 individuals. The incident did not affect student data within the PowerSchool system or the district’s payroll infrastructure. Impacted individuals were offered two years of identity protection services following the breach investigation.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Stonington Public Schools experienced a ransomware attack disclosed by district officials on or around September 25, 2021. The superintendent notified the school community that an investigation was ongoing but confirmed student data stored in the PowerSchool system remained unaffected. Initial public statements did not specify the attack’s operational impact, compromised systems, or whether data exfiltration occurred. No district website notice was published at the time of the initial disclosure.
On November 3, 2021, the district submitted a breach notification to the Maine Attorney General’s Office revealing attackers had accessed two file servers containing historical employee records. The incident affected 1,765 individuals, exposing personal information including names, dates of birth, mailing addresses, telephone numbers, Social Security numbers, health insurance identification numbers, and wage or tax-related data. Some records included information about employees’ dependents. District officials confirmed the payroll system was not compromised during the attack. Impacted individuals received offers for two years of identity protection and credit monitoring services. The district did not disclose whether a ransom was paid, the specific ransomware variant involved, or the initial attack vector leading to server compromise.