St. Joseph’s College of Maine notifies 126K people of data breach claimed by Clop ransomware

St. Joseph’s College of Maine over the weekend confirmed it notified 126,580 people of a December 2023 data breach that compromised SSNs and other private data.

“The investigation revealed that the unauthorized party gained access to our network between December 15, 2023, and January 24, 2024,” says the school’s notice to victims.

Ransomware gang Clop claimed responsibility for the breach in March 2024. It took the school more than a year after discovering the breach to notify victims.

St. Joseph’s has not verified Clop’s claim. We do not know whether the college paid a ransom, how much Clop demanded, or how attackers breached St. Joseph’s network. Comparitech contacted the college for comment and will update this article if it replies.

St. Joseph’s is offering eligible victims free identity theft protection through Experian.

Who is Clop?

Clop, or Cl0p, is a high-profile ransomware group that first surfaced in 2019. Its latest wave of claims mostly involve exploiting vulnerabilities in the Cleo file transfer software, which is used by many organizations. Like some other ransomware groups, Clop doesn’t always encrypt files. Instead, it demands ransoms solely in exchange for not selling or publishing stolen data.

Clop claimed some of the largest ransomware attacks to date, including those on Fortra (GoAnywhere) and MOVEit (Ipswitch). Those two attacks alone breached about 102 million records.

In 2023, Clop also claimed confirmed attacks on the Michener Institute, Texas Wesleyan University, and the Peddle School.

Chicago Public schools recently confirmed a Clop attack compromised the personal data of more than 700,000 people.

In 2025 so far, Clop claimed one confirmed attack on manufacturing company Uniek. The group claimed another 331 unconfirmed attacks this year that haven’t been acknowledged by the targeted organizations. Most of those claims stem from the Cleo vulnerability exploit.

Ransomware attacks on US education

Comparitech researchers logged 124 confirmed ransomware attacks on US schools colleges, and other educational institutions in 2023, compromising more than 3 million records.

2024 saw a dip with 72 such attacks compromising 2.5 million records.

In 2025 so far, we have tracked 10 confirmed attacks on US schools.

The average ransom is just under $700,000.

In addition to St Joseph’s and Chicago Public Schools, other recently confirmed attacks on US schools include:

Ransomware attacks on schools and other education facilities can disrupt day-to-day operations such as taking attendance, submitting grades, phone and email communications, billing, payroll, and assignments. Ransomware attacks are often two-pronged: they lock down systems and steal data. Schools that refuse to pay can face extended downtime, lose data, and put students and faculty at increased risk of fraud.

About St. Joseph’s College of Maine

St. Joseph’s College of Maine is a private Catholic college in Standish, Maine. It enrolls 1,700 students, the majority of whom attend online, according to the school’s website.