Hackers post video of MPS students and staff data

The hackers who shut down several Minneapolis Public Schools IT systems two weeks ago have posted a video on Vimeo showing them accessing personal staff and student data.

• Axios is not sharing the video so as not to further spread personal info.

The latest: The hackers, going by Medusa, posted the 51-minute video showing them opening files that include a letter to a student's parent about their child's suspension and transfer to another school.

• It also shows employee tax forms, HSA withdrawals, contracts with vendors and resumes of job applicants.
• The hackers are asking for MPS to pay a $1 million ransom to delete the stolen data.

What they're saying: MPS said in a letter to families and staff that it has reported the video to law enforcement and is working with IT specialists to review the data exposed in order to contact those whose info was shown.

• MPS also said it's asked Vimeo to take it down.

Cybersecurity expert Brett Callow of Emsisoft told Axios it's the first time he's ever seen such a tactic used by hackers.

• "If I was a parent/student/teacher/service provider, I'd work on the assumption that whatever info the district held about me was now in the hands of cybercriminals," he said.
• Cybersecurity experts have recommended watching bank accounts for unusual transactions and being on alert for phishing attempts.

Between the lines: The FBI recommends organizations against paying ransoms because it doesn’t guarantee the hackers will actually delete the data.