Minneapolis Public Schools
bd_524a24e43eef8603 · schema v1 · pii pii-v1
Full breach record for Minneapolis Public Schools →Threat-actor claim — not a regulatory filing
This row is a claim by the ransomware group Medusa on its public extortion blog. It has not been validated by the victim or any regulator. Treat attribution and counts as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.
Source: Ransomware.live
Post text · scraped from the leak site
Minneapolis Public Schools (MPS) or Special School District Number 1 is a public school district serving students in pre-kindergarten through twelfth grade from Minneapolis, Minnesota. Minneapolis Public Schools enrolls 36,370 students in public primary and secondary schools. The district administers about one hundred public schools including forty-five elementary schools, seven middle schools, seven high schools, eight special education schools, eight alternative schools, nineteen contract alternative schools, and five charter schools. With authority granted by the state legislature, the school board makes policy, selects the superintendent, and oversees the district's budget, curriculum, personnel, and facilities. Students speak ninety different languages at home and most school communications are printed in English, Hmong, Spanish, and Somali.
J jump to incidentP pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
Feb 17, 2023
Claim posted
—
Corroborated · see linked filings
This record's own dates cannot anchor compliance clocks; see the linked filings.
Claim → filing
—
Compliance clock
Not assessable
Linked disclosures
Why this link?Regulatory filings (6) · sorted by filing gap
- Montana State AGbd_0b239d4c54fc48822023-09-05 · +200dVerified by operator
- Indiana State AGbd_11a17eb8da1f746e2023-09-05 · +200dVerified
- Massachusetts State AGbd_371bdf2738cff1e12023-09-05 · +200dVerified by operator
- Vermont State AGbd_965f8261736818942023-09-05 · +200dVerified
Show 2 more filings ↓Show fewer ↑up to 200d gap
- Maine State AGbd_b96dbece1633723d2023-09-05 · +200dVerified by operator
- New Hampshire State AGbd_c3a500621ad44f582023-09-05 · +200dVerified by operator
Press reports (1)
- Pressmedusabd_f3c4fb86814cf4742023-02-17Candidate
Filing propagation · 6 filings · 6 states
View merged incident ↗Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
Source ceiling
- actor name
- victim claim
- ransom/leak status
- discovery date
- materiality
- notification
- affected count
- confirmed data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.
medusa
According to ransomware.live, Medusa is a ransomware-as-a-service operation active since June 2021 that has targeted over 300 victims across critical infrastructure sectors including healthcare, education, legal, and manufacturing using double-extortion, with attacks surging 42% between 2023 and 2024 and a formal CISA advisory issued in early 2025.