Portland Public Schools Hit by RansomHub Data Breach Affecting 12,000+ Individuals
Portland Public Schools (PPS) in Maine disclosed a February 2025 data breach in January 2026, notifying 12,128 individuals that their sensitive personal information was compromised. The exposed data includes names, Social Security numbers, financial account details, medical records, health insurance information, government-issued IDs, and dates of birth.
The ransomware group RansomHub claimed responsibility for the attack in May 2025, alleging it stole 110 GB of data from the district. To support its claim, the group posted images of purportedly stolen documents including ID scans, insurance records, budgets, and student health files on its leak site. PPS has not confirmed RansomHub’s involvement, and the authenticity of the data remains unverified. The district declined to answer questions about the breach’s cause, whether a ransom was paid, or the amount demanded.
PPS detected unauthorized network access on February 2, 2025, but a forensic investigation concluded on January 6, 2026, that personal data had been accessed or exfiltrated. The district is offering affected individuals free credit monitoring and identity theft insurance through Experian.
About RansomHub
RansomHub, a ransomware-as-a-service (RaaS) operation active since February 2024, has been linked to 767 claimed attacks between February 2024 and March 2025, with 163 confirmed by targeted organizations. Seventeen of those attacks involved schools or educational institutions, including recent breaches at Charleston County School District (SC), Crystal Lake Elementary District 47 (IL), and Indian Springs School District 109 (IL).
Broader Impact on Schools
Ransomware attacks on U.S. educational institutions remain a growing threat. In 2025 alone, researchers documented 51 confirmed attacks on schools, colleges, and universities, exposing over 3.9 million personal records. Recent incidents include Clackamas Community College (October 2025, 33,381 records exposed) and Trocaire College (March 2025, 23,436 records exposed). Beyond data theft, such attacks disrupt critical operations including attendance tracking, grading systems, communications, payroll, and student assignments while increasing fraud risks for victims.
Portland Public Schools, Maine’s largest district, serves 6,244 students across 16 schools and employs 1,524 staff.
Portland Public Schools, Maine cybersecurity rating report: https://www.rankiteo.com/company/portland-public-schools-maine
"id": "POR1770065924",
"linkid": "portland-public-schools-maine",
"type": "Ransomware",
"date": "2/2025",
"severity": "100",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '12,128 individuals',
'industry': 'Education',
'location': 'Maine, USA',
'name': 'Portland Public Schools',
'size': '6,244 students, 1,524 staff',
'type': 'Educational Institution'}],
'customer_advisories': 'Free credit monitoring and identity theft insurance '
'offered to affected individuals',
'data_breach': {'data_exfiltration': 'Yes',
'file_types_exposed': ['ID scans',
'Insurance records',
'Budgets',
'Student health files'],
'number_of_records_exposed': '12,128 individuals',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Names',
'Social Security numbers',
'Financial account details',
'Medical records',
'Health insurance information',
'Government-issued IDs',
'Dates of birth']},
'date_detected': '2025-02-02',
'date_publicly_disclosed': '2026-01',
'description': 'Portland Public Schools (PPS) in Maine disclosed a February '
'2025 data breach in January 2026, notifying 12,128 '
'individuals that their sensitive personal information was '
'compromised. The ransomware group RansomHub claimed '
'responsibility for the attack in May 2025, alleging it stole '
'110 GB of data from the district. PPS detected unauthorized '
'network access on February 2, 2025, and a forensic '
'investigation concluded on January 6, 2026, that personal '
'data had been accessed or exfiltrated.',
'impact': {'brand_reputation_impact': 'Yes',
'data_compromised': '110 GB',
'identity_theft_risk': 'Yes',
'operational_impact': 'Disruption of attendance tracking, grading '
'systems, communications, payroll, and '
'student assignments',
'payment_information_risk': 'Yes'},
'investigation_status': 'Completed (forensic investigation concluded on '
'2026-01-06)',
'motivation': 'Financial gain',
'ransomware': {'data_exfiltration': 'Yes', 'ransomware_strain': 'RansomHub'},
'references': [{'source': 'RansomHub leak site'}],
'response': {'communication_strategy': 'Notification to affected individuals, '
'offering free credit monitoring and '
'identity theft insurance through '
'Experian',
'third_party_assistance': 'Forensic investigation'},
'threat_actor': 'RansomHub',
'title': 'Portland Public Schools Hit by RansomHub Data Breach Affecting '
'12,000+ Individuals',
'type': 'Ransomware'}