2026 Chicago Public Schools — 700K students (Cleo vendor breach)
Data compromised
Names, DOB, gender, CPS ID numbers; Medicaid IDs and eligibility (344K students)
Technical writeup
Chicago Public Schools suffered a data breach via technology vendor Cleo (EDI file transfer software), compromised late 2024. CPS learned of unauthorized access Feb 8, 2026; notified March 7. Russian hackers exposed data for ~700K current and former students dating to 2017-2018. For ~344K students, Medicaid IDs and eligibility dates also exposed. Attackers broke encryption. Affected 60+ organizations nationwide. FBI and Illinois AG investigating.
Root cause
Third-party vendor compromise; Cleo software vulnerability