Elmbrook’s Cyber Security Breach Reaches Employee from Decades Prior

Meanwhile, Elmbrook gave an award to the company that does its data and network management.

A former Elmbrook employee recently spoke with the Journal Sentinel on 4/10/23 about her surprise of being affected by Elmbrook’s cyber security breach, since she only worked for Elmbrook a few years in the 2000s. The cyber breach was first communicated to parents on 8/29/22, but this former employee did not learn about it until March of 2023.

The former employee is concerned about her financial well-being and said, “That was also very surprising that I hadn't worked for the school system for so long and still my information was breached. I don't know much about breaches, but that's a big one if they breach information that goes that far back. One can only imagine how far back information has been breached even though this was a breach done last year.”

A couple months after the cyber security breach, Elmbrook honored Capital Data on 11/15/22 with a Wisconsin Association of School Boards (WASB) award. Capital Data is a managed service provider that does data and network management. Per Elmbrook documents, the WASB awards “celebrate business partnerships that provide exceptional value-add to our students, schools and community over the past year.”

Just days before the start of 22-23 school year, Chris Thompson, Elmbrook's Chief Strategy Officer, emailed parents alerting them of a network attack requiring all student passwords to be changed. His communication said, "While our investigation is in its early stages, we have found no evidence of sensitive data being compromised."

That statement did not turn out to be correct. Vice Society, the hacker group, listed Elmbrook Schools and Twitter picked that up on 9/4/22. Mark Hansen, Superintendent, admitted that staff and student data was posted to the dark web on 9/8/22, which was covered by local news here.

On 9/29/22, law firm Cole & Van Note announced an investigation into Elmbrook over this data breach and encouraged individuals who had their data posted on the dark web to reach out to them.