Mastery Schools Notifies 37,031 of Major Data Breach

A ransomware attack that compromised the personal data of 37,031 people has been confirmed by Mastery Schools, the largest charter school network in Philadelphia.

The breach, which occurred in September 2024, exposed a wide range of sensitive information, including Social Security numbers, medical details and student records.

Notifying Affected Individuals 

Mastery began sending official notices over the weekend to those affected. The school network said it detected the attack on September 15 2024, after an unauthorized actor encrypted systems. The incident disrupted key operations, including phone and email access.

The ransomware group DragonForce has claimed responsibility, stating it stole 171 GB of data from the school system and has since listed Mastery Schools on its leak site. However, Mastery has not verified that claim nor disclosed how the attackers gained access or whether a ransom was paid.

“[We] determined that an unauthorized actor downloaded some of our data,” Mastery said in its notification.

It added that there is no current evidence of identity theft or fraud linked to the breach.

Read more on ransomware attacks in education: Exploitation Accounts For 29% of Education Sector Attacks

The compromised data reportedly includes:

• Names

• Dates of birth

• Social Security numbers

• Taxpayer ID numbers

• Government-issued IDs

• Passport numbers

• Bank and financial information

• Credit and debit card details

• Biometric data

• Usernames and passwords

• Medical and health insurance info

• Student ID numbers

• Student records

Identity Protection and Response

To support victims, Mastery is offering free identity protection through Experian’s IdentityWorks service. Those impacted must enroll by August 31 2025.

CEO Dr. Joel Boyd said the organization is increasing its use of multi-factor authentication and enhancing endpoint monitoring to improve security going forward.

Mastery has also brought in external cybersecurity professionals and is working with federal law enforcement agencies to further investigate the breach and reduce the risk of future incidents.

Cyber-Threats in US Education Continue to Rise

According to Comparitech, 79 ransomware attacks hit US schools and colleges in 2024, affecting nearly 2.9 million records. Other recent victims include districts in Texas, Georgia, Virginia and New Jersey.

These attacks often lead to significant operational disruption, forcing delays in testing, payroll issues and system shutdowns.

Mastery Schools operates 23 campuses across Philadelphia and Camden, serving around 14,000 students. The network includes elementary, middle and high schools.