DisclosureLens
GLOBALUnknownRansomwareRhysidaLow

Prince George's County Public Schools

bd_d6c0f52f7e7c7bba · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Aug 14, 2023

To disclose

—

Affected

Not disclosed

Linked

8 filings

Confidence

60%
Full breach record for Prince George's County Public Schools →

Press / market disclosure — not a breach-notification filing

A media or market posting that confirms an incident but carries no breach-notification fields, so compliance clocks aren't assessable. The summary below is extracted from the coverage — verify against the source.

Prince George's County Public Schools impacted by cyberattack. Prince George's County Public Schools: Monday morning, Prince George's County Public Schools were the victim of a cyberattack. According to PGCPS, the attack affected 4,500 user accounts out of 180,000, primarily staff accounts. The main business and student information systems, Oracle and SchoolMAX, do not appear to have been affected. Although many network systems have been restored, all users will need to reset their passwords on August 15. PGCPS will contact affected users in the coming days with more information regarding their accounts, pending further review by a team of cyber experts. Linked ransomware group: rhysida.

Incident timeline — mostly unverified

? — ?

Breach window unknown

Aug 14, 2023

Press report

—

Corroborated · see linked filings

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

Attack → press

—

Compliance clock

Not assessable

This filing is one of 8 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (2)

Regulatory filings (5) · sorted by filing gap

Show 1 more filing ↓up to 196d gap

Filing propagation · 6 filings · 5 states

View merged incident ↗
PressAug 14 · first · this page
Indiana State AG+184d
Vermont State AG+186d
Maine State AG+186d
Massachusetts State AG+186d
New Hampshire State AG+196d

Pattern: first filing Aug 14, last Feb 26 (NH) — a 196-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market reportThis record

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source ceiling

  • incident type + narrative only (may be machine-translated)
  • discovery date
  • materiality
  • affected count
  • data types
  • compliance clock

The ✕ fields stay blank until a regulatory filing or victim disclosure lands.

About this groupFirst seen 2023-06-05

rhysida

According to ransomware.live, Rhysida is a ransomware-as-a-service (RAAS) group that emerged in May 2023. The group utilizes a namesake ransomware through phishing attacks and Cobalt Strike to breach the targets' networks and deploy their payloads. The group threatens to publicly distribute exfiltrated data if the ransom is not paid, and it's worth mentioning that Rhysida is still in the early stages of development. The ransomware leaves PDF notes in the affected folders, instructing victims to contact the group through its portal, and payment is made via Bitcoin. After encryption, the ransomware appends the extension '.ryshida' to encrypted files. Source: https://github.com/crocodyli/ThreatActors-TTPs

331 tracked hereFull profile →