Substitute Teacher Service Listed by cicada3301 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target organizations that hold operational and personal records, listing victims on leak sites to pressure payment and publicize claimed data theft. Against that backdrop, Substitute Teacher Service was named on 8 February 2025 by the group known as cicada3301. Public reporting indicates the group claims to have taken internal files totaling 210 GB; the number of people affected remains unknown, and independent confirmation of the full scope has not been released.

The listing itself is a claim by the actors rather than a verified disclosure from the organization. For anyone whose details may sit in the systems of a substitute-teacher staffing service, the incident raises concrete questions about what was taken and what practical steps follow.

Inside the incident

According to the available record, Substitute Teacher Service appeared on a cicada3301 leak-site listing dated 8 February 2025. The entry describes a ransomware attack in which internal files were allegedly exfiltrated and states a data volume of 210 GB. A countdown-style status of 6 days, 1 hour, 50 minutes and 24 seconds was also shown at the time of reporting. No further technical details—such as the initial access vector, encryption of systems, or any ransom demand—have been publicly confirmed. The number of individuals whose information may be involved is listed as unknown. Beyond the group’s own claim of file exfiltration, independent verification of the contents or the precise timeline of the intrusion has not been provided in the public facts.

Inside cicada3301

cicada3301 is a ransomware operation that has been observed listing victims on dedicated leak sites after claiming to have stolen data. Like many contemporary ransomware groups, it typically combines data exfiltration with encryption of systems and then uses the threat of public release to increase pressure. Public reporting on the group has described a pattern of targeting organizations across multiple sectors, posting sample files or volume claims, and setting timers that count down toward full publication. The group’s statements about any specific victim, including Substitute Teacher Service, remain claims until corroborated by the affected organization or independent forensic evidence. No additional statements attributed to cicada3301 about this particular incident appear in the available facts beyond the listing itself.

Who is Substitute Teacher Service?

Substitute Teacher Service operates in the education-staffing sector, matching temporary educators with schools that need coverage for absences. Organizations of this type routinely maintain databases of teacher credentials, contact information, employment histories, payroll or tax details, and sometimes background-check records, as well as school-district contracts and internal administrative files. Because the work involves personal data of educators and operational information about schools, a breach can affect both individual privacy and the continuity of educational services. The public facts do not describe the company’s size, exact location, or security posture; they simply identify it as the organization named in the cicada3301 listing.

The information in question

The facts state that internal files were exfiltrated in a ransomware attack and give a claimed volume of 210 GB. No specific categories—such as names, Social Security numbers, email addresses, or financial records—are itemized in the public record. Organizations that place substitute teachers typically hold precisely the kinds of records listed above: personal identifiers of educators, employment and certification data, and internal business documents. Whether any of those categories were among the 210 GB remains unconfirmed. Readers should treat the exact contents as undisclosed until further official information is released.

Why it matters

If personal or employment data belonging to substitute teachers or school contacts were included, those individuals face the ordinary risks that follow any exposure of such records: targeted phishing, identity-related fraud, or unwanted contact. For the organization itself, the claimed theft of internal files can disrupt operations, require notification obligations under applicable privacy laws, and create lasting trust issues with the school districts it serves. Because the number of people affected is unknown and the precise data types are not confirmed, the full scale of impact cannot yet be measured. The incident nonetheless illustrates how staffing services that sit between individuals and public institutions can become high-value targets for ransomware groups seeking both leverage and resaleable data.

What to do if you're exposed

Anyone who has worked with or supplied information to Substitute Teacher Service should monitor financial and credit accounts for unusual activity and be alert to unexpected messages that reference teaching credentials or school assignments. Consider placing a fraud alert or credit freeze if sensitive identifiers may have been involved, and change passwords on any accounts that reused credentials associated with the service. Because the exact data set remains unconfirmed, treat any communication that claims to come from the company or from the attackers with caution. As a practical next step, readers can run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets; such a scan provides an early indicator but does not replace official notifications from the organization itself.

AICompiled with AI assistance from public sources and published under our editorial standards.