The Clark County School District (CCSD) in Nevada is dealing with a potentially massive data breach, as hackers email parents their children's' data that was allegedly stolen during a recent cyberattack.
CCSD is the fifth largest school district in the US, with over 300,000 students and 15,000 teachers.
On October 16, CCSD confirmed it suffered a cyberattack earlier this month, stating threat actors gained access to the district's email servers.
"On approximately October 5, 2023, Clark County School District ("CCSD") became aware of a cybersecurity incident impacting its email environment," reads
a statement from the Clark County School District.
"Upon discovering the incident, CCSD immediately engaged a team of forensic experts to investigate the incident and ensure that CCSD operates within a safe and remediated email environment. CCSD is also cooperating with law enforcement's investigation."
"Thus far, the investigation revealed that the unauthorized party accessed limited personal information related to a subset of students, parents, and employees. CCSD is working diligently to identify all individuals whose information was impacted by this incident."
In response to the attack, CCSD disabled access to its Google Workspace from external accounts and has forced reset all student's passwords.
Since then, things have taken a turn for the worse, with parents reporting they are receiving emails from the threat actors warning that their child's data was leaked.
"I'm so sorry to tell you this but unfortunately your private information has been leaked. You should probably change your information in CCSD systems if that is possible," reads an email titled "CCSD Leak" seen by the
Las Vegas Review Journal.
"There are over 200,000 student profiles like this which have been leaked now by the hackers. Be careful out there. Don't shoot the messenger!"
According to a report from
KSNV News 3 Las Vegas, these emails include PDF files that contain students' stolen data, including student photos, addresses, student ID numbers, and email addresses,
Both students and parents are upset and scared that the threat actor has their data and could potentially use it for other malicious purposes, such as identity theft or further phishing attacks.
