Denver Public Schools disclosed in early March 2023 that an unauthorised actor had accessed and potentially downloaded files stored on district servers between December 13, 2022 and January 13, 2023. The district said roughly 15,000 current and former employees were affected.
The stolen material included the names and Social Security numbers of current and former participants in the district's employee health plan, along with bank account or pay card numbers, driver's licence numbers, passport numbers, health plan enrolment information and employee fingerprints. Denver7 and Biometric Update also reported that student identification numbers were among the data taken.
Chief Information Officer Dave Landy said the district had no indication that personally identifying information belonging to students was accessed. The district placed its discovery of the activity in January but did not tell employees until March 3, a delay of roughly two months that drew criticism in local coverage.
Denver Public Schools mailed notification letters to those affected, opened a call centre for questions and offered credit monitoring and identity theft protection. It said it had put additional measures in place to strengthen network security and had expanded data security training for staff. The district did not say how the intruder gained access to its servers.