Cybersecurity

Hackers Stole School Data. The District Left Teachers in the Dark

School officials in Tucson have said little about files stolen in a cyberattack. Troves of data, including Social Security numbers, showed up on the dark web.

A teacher sits at her desk at John B. Wright Elementary School in Tucson, Arizona.

Photographer: Cheney Orr/Bloomberg
Lock
This article is for subscribers only.

Classrooms across Tucson, Arizona, were ravaged by ransomware in January that locked up computer systems and forced teachers to revamp lesson plans. Officials in southern Arizona’s largest school district tried assuring students and staff for weeks that, despite the cyberattack, sensitive data wasn’t stolen.

But Bloomberg News found that cybercriminals made off with gigabytes of files, containing tens of thousands of current and former employees’ Social Security numbers and other confidential records. They then uploaded the information in February to the dark web for anyone to access with an easily downloadable browser. The data were still accessible as recently as April 17.