Florida High School hacked by ransomware gang; SSNs and credit cards stolen

Saint Thomas Aquinas High School in Ft. Lauderdale, FL this week confirmed it notified 37,064 people of a July 2024 data breach that compromised the following personal info:

• Names
• Social Security numbers
• Financial information
• Bank account numbers
• Credit and debit card numbers
• Driver’s license numbers
• Passport numbers
• Student ID numbers
• Medical info
• Health insurance info

Ransomware gang Medusa claimed responsibility for the attack. It says it stole 104 GB of data and demanded $200,000 in ransom.

Saint Thomas did not verify Medusa’s claim. We do not yet know whether the school paid a ransom, how much Medusa demanded, or how attackers breached the school’s network. Comparitech contacted school officials for comment and will update this article if they respond.

The school is offering eligible victims free credit monitoring and identity theft protection via Transunion. The enrollment deadline is 90 days from receipt of the notice letter. However, the letter states that minors under the age of 18 might not be able to enroll, which would include most of the school’s students.

“On or about July 16, 2024, St. Thomas experienced unauthorized access to our network,” the school’s notice to victim states. “After an extensive forensic investigation and comprehensive document review, we determined on October 22, 2024, that some of your personal information stored on our network may have been accessed and/or acquired by an unauthorized individual.”

Who is Medusa?

Medusa first surfaced in September 2019 and debuted its leak site in February 2023, where it publishes stolen data of victims who don’t pay ransoms. Medusa often uses a double-extortion approach in which victims are forced to pay twice: once to decrypt their systems, and once for not selling or publishing stolen data.

Since it debuted its leak site, Medusa has claimed 102 confirmed ransomware attacks, compromising more than 2.1 million records. Its average ransom demand is $690,000.

Medusa lists many schools among its targets. It attacked Tri-City College Prep High School in June 2024 and the International University of Sarajevo earlier this month.

Medusa claimed another 97 attacks that haven’t been confirmed by targeted organizations.

Ransomware attacks on US education

Ransomware attacks on schools and other education facilities can disrupt day-to-day operations such as taking attendance, submitting grades, phone and email communications, billing, payroll, and assignments. Many schools cancel classes in the wake or ransomware attacks. Ransomware attacks are often two-pronged: they lock down systems and steal data.

In 2024 so far, Comparitech researchers logged 56 confirmed ransomware attacks on US schools, universities, and other education providers, compromising 300,534 records. The average ransom is $460,000.

Other recently confirmed ransomware attacks on US schools include those on Bartow County School System (attacked by Chort in October), Abilene Independent School District (attacked by Cloak in June), and Interboro School District (attacked by RansomHub in October).

Another 65 such attacks were claimed by ransomware gangs but not acknowledged by targets.

About Saint Thomas Aquinas High School

Founded in 1936, St. Thomas Aquinas High School is a private Catholic college prep school in Fort Lauderdale, Florida. It enrolls about 2,400 students in grades nine through 12, and employs 130 faculty.