Breach Notifications

A technology vendor for CPS called Battelle for Kids recently notified CPS that on December 1, 2021, Battelle for Kids was the victim of a ransomware attack on a server used to store CPS student and staff information for school years 2015-2016, 2016-2017, 2017-2018 and 2018-2019. Battelle for Kids is a nonprofit technology organization that stores student course information and assessment data for the purposes of teacher evaluations.

Specifically, an unauthorized party gained access to 495,448 student records which included name, date of birth, gender, grade level, school, Chicago Public Schools student ID number, State Student ID number, information about the courses students took, and student scores from performance tasks used for teacher evaluations during school years 2015-2016, 2016-2017, 2017-2018 and/or 2018-2019. The unauthorized party also gained access to 56,138 staff records which included name, school, employee ID number, CPS email address, Battelle for Kids username, and information about courses taught during the aforementioned school years. The server did not store any other information about students or staff. No Social Security numbers, no financial information, no health data, no current course or schedule information, no home addresses, and no course grades, standardized test scores, or teacher evaluation scores were involved in this incident. 

CPS is sending personalized emails with the subject line “Notification of Unauthorized Disclosure of Student/Staff Information” to impacted families and staff members about this incident, including former CPS families and former staff who were impacted. In the coming days, CPS will follow up with a personalized physical letter to the last known address of impacted families and staff members, including former CPS families and staff who are no longer with the district. Families will receive one communication per child impacted. We are also notifying families and staff that were not impacted by this incident to provide them with peace of mind. 

Some families may have some children who were impacted by the breach and other children who were not. Each notification is personalized to ensure families and staff are aware of exactly who was impacted by the breach.

First, you should know that as of this time, there is no evidence to suggest that this data has been misused, posted, or distributed. According to data security experts, including law enforcement, the lack of financial information contained in the data decreases the likelihood that the data will be misused.

Regardless, we know that impacted families and staff may be concerned about fraudulent activity on their behalf or their child(ren)’s behalf.

Impacted families and staff can access a free credit report through annualcreditreport.com, a free resource authorized by the federal government. Additionally, the following credit reporting agencies offer a free service allowing you to receive fraud alerts and to freeze access to your credit if necessary:

• Experian - https://www.experian.com/fraud/center.html, or 1-888-397-3742, or P.O. Box 2002, Allen, TX 75013.
• TransUnion - https://www.transunion.com/fraud-victim-resources, or 1-833-395-6938, P.O. Box 2000, Chester, PA 19022.
• Equifax - https://www.equifax.com,  or 1-888-378-4329, or  P.O. Box 740241, Atlanta, GA 30374.

We also encourage impacted families and staff to visit the Federal Trade Commission (FTC) website at https://www.identitytheft.gov/#/Info-Lost-or-Stolen for more information about fraud alerts and security freezes from consumer reporting agencies. Impacted families and staff may also contact the FTC at 1-800-FTC-HELP (1-800-382-4357).

As of this time, there is no evidence to suggest that this data has been misused, posted, or distributed. According to data security experts, including law enforcement, the lack of financial information contained in the data decreases the likelihood that the data will be misused.

Battelle for Kids is currently monitoring and will continue to monitor the internet in case the data is posted or distributed. If the information is posted on the internet, CPS will notify impacted families with next steps and resources to safeguard information. In addition, the identity theft protection and credit monitoring provided by CPS will notify you if your specific information is posted.

We encourage families to always be vigilant and closely monitor financial accounts for fraudulent activity.

In the unlikely event that this information is used for fraudulent activity or identity theft, report the activity to the Federal Trade Commission (FTC) online at IdentityTheft.gov or by phone at 1-877-438-4338. The FTC will collect the details of your situation and advise you on next steps.

CPS received a letter on April 26, 2022 via U.S. Mail from Battelle for Kids which notified us of a security incident involving student data that occurred in December 2021. CPS did not have specific information as to which students were affected, nor did CPS know that staff information was also compromised until May 11, 2022.

Our vendor, Battelle for Kids, informed us that the reason for the delayed notification to CPS was the length of time that it took for Batelle to verify the authenticity of the breach through an independent forensic analysis, and for law enforcement authorities to investigate the matter. 

Regardless, our contract with Battelle for Kids states that CPS is to be notified of any data breach immediately. We are addressing the delayed notification and other issues in the handling of data with Batelle for Kids. We are also working to ensure all vendors who use CPS data are handling that data responsibly and securely to prevent this sort of incident from ever happening again.

CPS includes strong language in all of our vendor contracts to ensure the protection and security of personal information. We are working to ensure all vendors who use CPS data are handling that data responsibly and securely in compliance with their respective contracts to prevent this sort of incident from ever happening again.

Battelle for Kids has informed CPS that they have taken several mitigation measures to reduce the risk of this type of incident occurring in the future, including a plan for the timely and secure deletion of outdated data, migration to enterprise cloud services, enhanced network security, and the retention of a third-party security firm for up-to-date defenses and industry-leading practices for the ever-evolving needs of cybersecurity.

Yes. This incident has been reported to and investigated by the appropriate law enforcement authorities, including the Federal Bureau of Investigation (FBI) and the Department of Homeland Security (DHS).

Battelle for Kids is currently in the process of verifying current class rosters for this school year for the purposes of teacher evaluations. However, please be aware that no current student information was compromised in this incident. 

Battelle for Kids has informed CPS that they have taken several mitigation measures to reduce the risk of this type of incident occurring in the future, including a plan for the timely and secure deletion of outdated data, migration to enterprise cloud services, enhanced network security, and the retention of a third-party security firm for up-to-date defenses and industry-leading practices for the ever-evolving needs of cybersecurity.