HackingCustomer Data InvolvedEmployee Data InvolvedIDENTITY_BASICCREDENTIALSLowContained
Baltimore City Public Schools
bd_9ab6c0fe1104bebb · schema v1 · pii pii-v1
Full breach record for Baltimore City Public Schools →Baltimore City Public Schools notified consumers of a cybersecurity incident discovered on Feb 13, 2025. Files containing names and other data elements were taken from the network. The district engaged law enforcement and external experts, implemented EDR, and reset passwords. Affected individuals are offered two years of complimentary credit monitoring and identity theft restoration services.
Vermont clock✗ VT AG >45 bday11 weeks discovery → filing
⚠ occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
This filing is one of 5 about the same incident.View merged incident
Linked disclosures
Why this link?Regulatory filings (4) · sorted by filing gap
- bd_bb5f9b0432bd4ec5Maine State AGfiled 2025-04-29Candidate
- bd_da05d89cd8b7eef7New Hampshire State AGfiled 2025-04-29Verified
- bd_e3c3ec5edab65991Idaho State AGfiled 2025-04-28(1d gap)Candidate
- bd_1aa674a0a361f7e3Indiana State AGfiled 2025-04-24(5d gap)Verified
Source provenance
- Source URL
- https://ago.vermont.gov/document/2025-04-29-baltimore-city-public-schools-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
- Filed at
- Apr 29, 2025
- Raw hash
- c23c2b7d30a47c626ae3a5d08441d156da91ba059348fa700f979eff7c2dd3dc
Reporting entity
- Name
- Baltimore City Public Schoolsnorm: baltimore city public schools
Victim entity
- Name
- Baltimore City Public Schoolsnorm: baltimore city public schools
Incident
- Discovered
- Feb 13, 2025
- Materiality determined
- —
- Notification sent
- Apr 29, 2025
- Affected individuals
- Not disclosed
- Data types
- IDENTITY_BASICCREDENTIALS
- Attack vector
- Unauthorized Access
- MITRE ATT&CK
- T1078 Valid AccountsT1119 Automated Collection
- Threat actor
- ExternalFinancial
- Regulator citations
- Notified law enforcement
Compliance
- Time to disclose
- 11 weeks(75 days from discovery to filing)
- Compliance flags
- VT AG >45 bday
- Discovery-date grounding
- occurrence dateThe stored discovery date equals the breach OCCURRENCE date. Detection is normally later, so this OVERSTATES the delay — a 'late' verdict here may not be real.
Extraction provenance
- Status
- No extraction artifact recorded for this disclosure.