The Cloak ransomware group breached Baltimore City Public Schools’ IT systems on February 13, 2025, stealing sensitive data from over 25,000 students, staff, volunteers, and contractors dating back to 2010. Stolen data includes Social Security numbers, driver’s license and passport info, birth certificates, and addresses—some of which has surfaced on the dark web. The district refused to pay ransom and involved law enforcement. While IT systems remained operational, officials have offered two years of free credit monitoring, reset passwords, and hired cybersecurity firm CrowdStrike to strengthen defenses.