Hackers emailed stolen student records to Clark County School District parents

Clark County School District in Nevada, the fifth largest school system in the United States with more than 300,000 students and around 15,000 teachers, told families on October 16, 2023 that an unauthorized party had reached personal information belonging to some students, parents and employees. The district said it became aware of the incident in its email environment around October 5 and had engaged forensic experts and cooperated with law enforcement.

The situation escalated later in the month. A group calling itself SingularityMD emailed parents directly, attaching PDF files containing their own children's records. Parents described the attachments as holding student photographs, home addresses, contact details and student identification numbers. The group said it had taken 68.8 GB of data and had published roughly 4 GB covering about 200,000 students, including health information, test scores and disciplinary reports.

SingularityMD told reporters it had begun from a compromised student account and escalated to teacher and then system level access, and it criticised the district for years of resetting student passwords to their birthdates. It demanded a payment it described as less than a third of the superintendent's annual salary in exchange for destroying the files, and claimed it still had access to the district's network.

The district restricted Google Workspace access to its internal network, forced student password resets, disabled automatic email forwarding, limited external document sharing and said it would add multi-factor authentication on shared accounts. It notified affected individuals by mail and opened a dedicated assistance line. No ransomware deployment was reported; the extortion rested on stolen data alone.