Chicago Public Schools (CPS) and law enforcement agencies, including the FBI and the Illinois Attorney General’s office, are investigating a significant data breach that has compromised the personal information of approximately 700,000 current and former students. The breach stems from a cyber-attack on Cleo, a third-party file transfer software vendor used by the district, which resulted in student data being accessed and published on the dark web.
According to CPS, the compromised data dates back to the 2017-18 school year and includes students’ names, dates of birth, genders, and CPS student identification numbers. Additionally, students enrolled in Medicaid had their Medicaid ID numbers and eligibility dates exposed. However, the school district assured the public that the breach did not affect Social Security numbers, financial information, health records, and staff data.
In an official statement, CPS emphasized that no evidence indicates misuse of the stolen data. “At this time, no evidence suggests that any student data has been misused. No staff information was involved in this incident,” the statement read. The district has since taken steps to notify law enforcement authorities and affected families while working to assess the full scope of the breach.
CPS also reaffirmed its commitment to student data security and vendor accountability. “CPS is deeply committed to the security of student information, and we expect the same level of care and commitment from our vendors,” the district stated. “As an organization, CPS takes proactive measures to limit exposure by continuously strengthening our defenses and including strong provisions in vendor contracts to protect data. Through ongoing diligence and improvement, we will continue to adapt our security posture to reduce the risk of future breaches.”
In the wake of the cyber-attack, CPS has directly communicated with families to address concerns and provide assurances regarding their data security measures. The district has also pledged to review and enhance its cybersecurity protocols to prevent similar incidents in the future.
