RansomHub ransomware group lists www.portlandschools.org on its leak site

• Ransomware group: RansomHub
• Country: United States
• Sector: Education
• Announcement date: March 6, 2025

Portland Public Schools targeted by RansomHub

Portland Public Schools has been listed on the leak site of the ransomware group RansomHub. The threat actor group claims to have successfully exfiltrated institutional data belonging to the school district, marking a significant potential breach for the educational entity.

Ransomware leak sites are specialized platforms used by cybercriminal groups to pressure victims into paying ransoms. In many modern attacks, groups employ a strategy known as double extortion. In this scenario, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information before the encryption occurs. If the victim refuses to pay the ransom to restore their systems, the attackers threaten to publish the stolen data on these public leak sites to cause reputational damage, legal repercussions, or direct harm to the individuals whose data was stolen.

Details of the alleged attack

According to the announcement made by RansomHub on March 6, 2025, the group alleges that they gained unauthorized access to the networks of Portland Public Schools. The group claims that this access allowed them to exfiltrate a large volume of files from the institution's systems. To support these allegations, the group has provided screenshots of various documents that appear to be related to the educational operations of the district.

While the group has published a claim regarding the breach, no information was provided regarding the specific size of the data stolen or the specific ransom demand. The group's claim of the attack date is listed as March 5, 2025, one day prior to the public announcement on their leak site.

Alleged sensitive data exposure

The data allegedly stolen by the RansomHub group is highly sensitive, encompassing various types of personal and institutional information. The exposure of such diverse datasets suggests a deep penetration into the organization's digital environment. The information reportedly includes:

• Student health records
• Employee salary and benefits data
• Insurance policies
• Identity documents (such as passports and residence permits)
• Various contracts

The inclusion of identity documents like passports and residence permits, alongside health and financial records, significantly increases the risk profile of the incident. Such data is highly valuable on the dark web for identity theft and other fraudulent activities.

Organization profile and potential impact

Portland Public Schools is a school district located in the state of Maine, United States. The district provides primary and secondary education services to students in the city of Portland.

The alleged leak poses a severe risk of identity theft for the individuals involved, specifically students and staff members, due to the exposure of their sensitive personal data. Because the institution operates within the education sector, this incident may lead to significant compliance issues regarding student data protection regulations, such as the Family Educational Rights and Privacy Act (FERPA). Furthermore, the wide variety of exposed documents could potentially impact the institution's operational security, as well as its relationships with suppliers and third-party partners.

RansomHub is a Ransomware-as-a-Service (RaaS) group that emerged in early 2024. The group is known to have absorbed affiliates from the ALPHV group. Although reports indicated that the group's activities may have ceased in early 2025, this specific leak highlights that such incidents can still lead to secondary extortion risks. Organizations in the education sector can mitigate these risks by implementing robust data encryption, maintaining strict access controls, and ensuring rigorous compliance with privacy regulations to protect student and employee information.