South St Paul Public Schools
bd_aee79ac850f31eb9 · schema v1 · pii pii-v1
Full breach record for South St Paul Public Schools →Press / market disclosure — not a breach-notification filing
A media or market posting that confirms an incident but carries no breach-notification fields, so compliance clocks aren't assessable. The summary below is extracted from the coverage — verify against the source.
South St. Paul Public Schools investigating potential cybersecurity threat - Twin Cities. South St. Paul Public Schools: South St. Paul Public Schools reported a technology disruption due to unauthorized activity on their computer network. They took their systems offline to isolate the issue and engaged a cybersecurity firm to investigate and restore systems. The district is now focused on restoring services and maintaining a productive learning environment for students and staff. Linked ransomware group: blacksuit.
J jump to incidentP pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
Mar 4, 2024
Press report
—
Corroborated · see linked filings
Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.
Attack → press
—
Compliance clock
Not assessable
Linked disclosures
Why this link?Ransomware claims (2)
- Leak Siteblacksuitbd_b160dfc904bc785f2024-03-15 · +11dCandidate
- Leak Siteblacksuitbd_9454374241a1b5682024-03-04Verified by operator
Regulatory filings (1) · sorted by filing gap
- Indiana State AGbd_dede04627783d9012024-04-05 · +32dVerified by operator
Filing propagation · 2 filings
View merged incident ↗Pattern: first filing Mar 4, last Apr 5 (IN) — a 32-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
Source ceiling
- incident type + narrative only (may be machine-translated)
- discovery date
- materiality
- affected count
- data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.
blacksuit
According to ransomware.live, According to Trend Micro, this ransomware has significant code overlap with Royal Ransomware.