Mastery Schools experienced a September 2024 cyberattack that disrupted phone and email access and internet-dependent lessons. Later notices confirmed malicious encryption and downloaded personal data; DragonForce’s claim remains unverified.
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Unauthorized access to systems, accounts, networks, or data.
Data was copied, transferred, downloaded, or otherwise removed from the affected environment by an unauthorized party.
Data was rendered inaccessible through unauthorized encryption, including ransomware-related encryption.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
Internal or external network connectivity was unavailable or materially impaired.
The organization lost or materially restricted internet connectivity.
Email sending, receiving, access, or related messaging functions were unavailable or materially impaired.
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
A specific application or software platform became unavailable or unusable.
Instruction, student services, school administration, learning platforms, transportation, or other educational operations were materially affected.
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
Mastery Schools experienced a confirmed cyberattack that disrupted school technology and compromised personal information. The network’s official notice says it detected malicious encryption on Sept. 15, 2024, and shut down systems to contain the intrusion. Investigators subsequently determined that an unauthorized actor downloaded data. These findings support high confidence in ransomware involvement, independently of the later DragonForce claim.
Early local reporting documented unavailable phone lines, restricted email access and disruption across the network, while schools remained open. Classes continued despite disruption to network-dependent instruction and communications. The later confidentiality findings add a separate consequence; they do not establish that the school technology outage continued into 2025.
The Philadelphia Inquirer reported that internet-dependent lessons and electronic assignment submission were affected. A teacher at Hardy Williams described staff using paper plans or improvising instruction after being told the internet was down. That account qualifies the network’s initial statement that classroom instruction was unaffected. It does not establish identical conditions in every classroom.
Families were given direct cellphone contacts as an alternative to school phone lines. The network served schools in Philadelphia and Camden, but the reporting does not identify a device-by-device failure inventory or show that each separately organized school suffered the same technical compromise. Shared administrative and technology support connects these school operations; management agreements alone do not establish corporate ownership.
Confidence is high that malicious activity caused operational disruption and that data was copied. The official notice identifies possible categories spanning personal identifiers, financial information, health information and student records, with different information applicable to different people. Comparitech’s June 2025 report gives a notification total of 37,031. This is a reported notice population, rather than a count of students who lost classroom access.
DragonForce attribution remains low confidence. Comparitech reports a claim of 171 GB, and the native claim tracker associates Mastery Schools with DragonForce. Neither the organization nor reviewed technical evidence confirms that group’s responsibility or the claimed quantity. The tracker discovered the listing on Oct. 29, 2024; that timestamp does not establish the original claim-publication date or a second attack.
The initial access method, earliest unauthorized access, encryption scope, data volume, ransom demand and payment outcome remain unverified. A Sept. 18 syndicated report carries the chief executive’s security-specific explanation, attributed to Tuesday. The exact public release time of that statement is unresolved, and it should not be assigned the original Sept. 16 dateline of an article updated later.
Sept. 17 reporting is the latest verified account of continuing school-service disruption in the reviewed record. No source establishes a universal restoration date, so the incident is presumed resolved based on elapsed time, with no exact end date asserted. Later monitoring enrollment, breach notices and security improvements do not extend the outage. Original regulator letters, dated network updates or forensic findings could refine these bounds.
DragonForce claimed Mastery Schools. Comparitech reports a claimed 171 GB; responsibility and quantity are not victim-confirmed. Native tracker discovery is not original posting. Independent confirmation of encryption and theft does not identify the group.
County-level physical-site anchor for the Camden school campuses. This does not make county government a victim or establish a countywide outage.
Physical-site anchor for the network’s Camden school operations, including Cramer Hill at 1001 North 17th Street, Mastery High School of Camden at 800 Erie Street and East Camden Middle at 3064 Stevens Street. Historical school-year roster and financial report establish actual sites. Network-wide disruption is reported, but school-by-school technical scope is unverified.
Physical-site anchor for the central office at 5700 Wayne Avenue, Lenfest at 35 South Fourth Street and Hardy Williams at 5400 Warrington Avenue. Original coverage directly documents Hardy Williams instructional effects. Reuse the consolidated city/county location; this does not assert a citywide outage.
Reports school phone and email disruption and impaired internet-dependent instruction while campuses remained open.
A Hardy Williams teacher described interrupted internet-dependent lessons, paper backups and improvised instruction. The network supplied alternate cellphone contacts.
School phone service was down and email access limited. Families received direct cellphone contacts, and students and parents disputed the initial no-instructional-impact description.
The report attributes shutdowns to suspicious activity from an unauthorized external source, citing the network’s chief executive.
The native tracker identifies Mastery Schools, masterycharter.org, United States, education sector, as a DragonForce-claimed victim.
Mastery reports malicious encryption detected Sept. 15, 2024, containment shutdowns and investigation findings that an unauthorized actor downloaded personal data.
Reports 37,031 notifications and DragonForce’s unverified 171 GB claim; the victim had not confirmed attribution.
Signed-in members can report an error, update, or missing source.
