Personal data of 26,000 people exposed in Alamo Heights ISD data breach
An Alamo Heights Independent School District March data breach exposed the personal information of more than 26,000 people, according to a filing posted on the Texas Attorney General's Office website Monday. Personal data exposed included Social Security numbers, driver's license numbers and financial or medical information.
The district was the target of a cyberattack in late March that left staff and students without internet access for nearly a week. An AHISD spokeswoman confirmed the March incident was the same one referenced in Monday's filing.
"Following the forensic investigation, Alamo Heights Independent School District discovered that personal information was accessed and potentially downloaded as a result of the incident. Accordingly, we promptly notified impacted individuals in accordance with relevant breach notification requirements," spokeswoman Julie Ann Matonis said in a statement Tuesday. She noted that "day-to-day operations" have returned to normal.
Texas law requires government bodies to report security breaches that affect 250 or more Texans to the attorney general's office within 30 days of discovering the breach. Organizations must also provide notice to the people affected. AHISD officials notified those affected by U.S. mail, according to the filing.
In March, the district worked to restore its system during the weeklong attack and after, officials investigated the breach. Throughout the incident, district officials kept community members updated, but they did not answer questions about the scope of the attack or what, if any, personal information was released. The district would not confirm whether it paid any ransom as part of the attack .
The district's cyber insurance paid more than $36,000 to restore systems, according to an email from district CFO Matthew Streger to the insurance company that the Express-News obtained through a public records request.
Shop Spurs Gear
Celebrate the run Spurs shop promo
Ransomware attacks against school systems are not unique to AHISD. Judson ISD paid hackers a ransom of over $500,000 in 2021 to protect personal information following a month-long attack that shut down the district's phones, computers and email systems. Uvalde CISD also canceled classes for part of a week in September due to an attack.
Texas lawmakers passed Senate Bill 820 in 2019, mandating that districts adopt cybersecurity policies. Districts must designate a cybersecurity coordinator and have a process to report breaches to the Texas Education Agency.
The TEA launched a K-12 Cybersecurity Initiative in 2023 to help school districts prevent ransomware and phishing attacks. Texas legislators approved an additional $42 million in funding to extend the program through 2027.
Copyright 2026 Tribune Content Agency. All Rights Reserved.