Portland Public Schools Hit by RansomHub Data Breach Affecting 12,000+ Individuals Portland Public Schools (PPS) in Maine disclosed a February 2025 data breach in January 2026, notifying 12,128 individuals that their sensitive personal information was compromised. The exposed data includes names, Social Security numbers, financial account details, medical records, health insurance information, government-issued IDs, and dates of birth. The ransomware group RansomHub claimed responsibility for the attack in May 2025, alleging it stole 110 GB of data from the district. To support its claim, the group posted images of purportedly stolen documents including ID scans, insurance records, budgets, and student health files on its leak site. PPS has not confirmed RansomHub’s involvement, and the authenticity of the data remains unverified. The district declined to answer questions about the breach’s cause, whether a ransom was paid, or the amount demanded. PPS detected unauthorized network access on February 2, 2025, but a forensic investigation concluded on January 6, 2026, that personal data had been accessed or exfiltrated. The district is offering affected individuals free credit monitoring and identity theft insurance through Experian. About RansomHub RansomHub, a ransomware-as-a-service (RaaS) operation active since February 2024, has been linked to 767 claimed attacks between February 2024 and March 2025, with 163 confirmed by targeted organizations. Seventeen of those attacks involved schools or educational institutions, including recent breaches at Charleston County School District (SC), Crystal Lake Elementary District 47 (IL), and Indian Springs School District 109 (IL). Broader Impact on Schools Ransomware attacks on U.S. educational institutions remain a growing threat. In 2025 alone, researchers documented 51 confirmed attacks on schools, colleges, and universities, exposing over 3.9 million personal records. Recent incidents include Clackamas Community College (October 2025, 33,381 records exposed) and Trocaire College (March 2025, 23,436 records exposed). Beyond data theft, such attacks disrupt critical operations including attendance tracking, grading systems, communications, payroll, and student assignments while increasing fraud risks for victims. Portland Public Schools, Maine’s largest district, serves 6,244 students across 16 schools and employs 1,524 staff.