An unknown number of students at Great Hearts Academies and their parents had their names and contact information stolen by a hacker in a ransomware attack earlier this year, Arizona Mirror has learned.
The attack took place between Feb. 7 and May 20, but Great Hearts Academies — which operates 22 charter schools in Arizona and 11 in Texas — only began notifying those whose data was breached on Nov. 16.
“[W]e are writing to let you know about a data security incident with a third-party service provider used by Great Hearts which may have involved your personal information and how the situation has been resolved,” Great Hearts Academies wrote in an email to affected families obtained by the Mirror.
The school noted that credit card information, bank account numbers, social security numbers and other sensitive information was not a part of the breach.
The third-party vendor, Blackbaud, primarily works with nonprofits and other organizations that focus on “social good” by providing them with services like database software and processing for payments.
Great Hearts Academies said it was notified by Blackbaud of the breach and began working with them “over the summer.”
The same attack that affected Great Hearts Academies appears to have been impacting many other institutions, such as hospitals in Connecticut and a hospital in Delaware where 78,000 patients were notified.
The company is also being sued in 23 proposed consumer class action lawsuits related to the breach.
It is unclear how many Arizonans were impacted by the breach. A representative from Great Hearts Academies said questions regarding the breach should be directed to Blackbaud.
“To respect the privacy of our customers, we aren’t disclosing the total number of customers (or any segment) involved in the incident,” a Blackbaud spokesperson said in response to the Mirror’s questions. “Those customers which were part of this incident have been notified. We will not be commenting beyond the statement on our website.”
Since 2005, Arizona has lost a total of $1.6 billion from data breaches, according to researchers.