Rhysida Claims Attack on Phoenix Charter Academy, Alleging Student Immigration and Special-Education Records Were Taken
The ransomware group listed the Massachusetts charter school network on its dark-web site on 31 October 2026, claiming access to deeply sensitive data about children and their families. The school has not confirmed any incident.
Key points
- Rhysida listed Phoenix Charter Academy on its dark-web leak site on 31 October 2026, claiming to have stolen data affecting students, families and staff across three Massachusetts campuses.
- The group's post alleges the stolen files include immigration records belonging to students' families and special-education records for named minors, among the most sensitive categories any school holds.
- Phoenix Charter Academy has not publicly confirmed any incident, and the claim could not be independently verified at publication time.
- Rhysida has now appeared in three Threat Vectr stories since our first report on the group on 31 August 2026.
Phoenix Charter Academy, a public charter school network serving campuses in Chelsea, Lawrence and Springfield focused on low-income and immigrant families, was listed on Rhysida's dark-web site on 31 October 2026. The monitoring service Ransomware.live first observed the listing that day.
Ransomware groups run so-called leak sites: hidden websites where criminals name organisations they claim to have attacked, threatening to publish stolen data unless a ransom is paid. Listings are sometimes exaggerated or outright false, and they frequently appear before any public statement from the named organisation.
What does the group claim to have taken?
The alleged data is unusually sensitive, even by the standards of school breaches. The group's post purportedly includes special-education records for named minor students, family immigration documents and staff financial files. Those are broad categories; the exact contents, if any data was in fact taken, are unverified.
The post claims roughly 36,829 files totalling 445.1 GB were exfiltrated, and alleges access to internal school servers and a test server connected to PowerSchool, the widely used student-records platform. Every figure in that post deserves scepticism: it was written by attackers to maximise pressure on the school.
Phoenix Charter Academy serves a community where many families have limited English and limited experience navigating institutional data-breach processes. That context makes the alleged exposure of immigration-related documents particularly consequential if the claim proves true. As we reported on 8 October 2026, a similar claim against a school for students with dyslexia showed the same pattern: acutely sensitive records, an unconfirmed listing, families left waiting.
Should students' families and staff be worried?
The claim isn't confirmed, so there's no established fact to act on yet. Still, the nature of the alleged data makes a few precautions sensible now.
Anyone connected to Phoenix Charter Academy should watch for phishing: fake emails or texts pretending to be from the school or a government body. Don't click links in unsolicited messages.
Be sceptical of any call offering "breach compensation" or asking you to confirm personal details. These scams routinely exploit breach headlines.
Staff who reuse passwords across accounts should change any credential that shares a password with their school login, regardless of how this claim resolves.
Families worried about immigration-related records should contact a trusted legal aid organisation rather than responding to any unsolicited contact claiming to be from the school or an official body.
Education sits alongside healthcare as a recurring Rhysida target: schools hold rich personal data and typically run lean IT teams. No US federal regulator has confirmed jurisdiction over this incident, and no breach-notification filings were publicly visible at the time of writing.
