Substitute Teacher Service, Inc. data breach

What we know

Substitute Teacher Service, Inc. operates as a specialized educational staffing and human resources management agency, supplying temporary and substitute educators to public and private school districts. Because of the vital role they play in bridging workforce gaps for educational institutions, they function as a centralized repository for vast amounts of highly sensitive personal data. The company routinely collects, processes, and stores comprehensive records not only for the substitute teachers they vet and employ, but frequently for the students and school personnel who interact with their placement platforms. This dynamic requires them to manage an extensive infrastructure of personnel files, background check documentation, and onboarding materials.

The security incident reported by Substitute Teacher Service, Inc. to the Maryland Attorney General in 2025 highlights the mounting vulnerabilities faced by educational staffing and administrative vendors. While specific attack vectors vary, data security incidents impacting this sector typically involve unauthorized access to internal databases, compromise of administrative credentials, or sophisticated ransomware deployments targeting legacy human resources systems. Educational service providers represent high-value targets for cybercriminals because their networks house a dense concentration of interconnected personally identifiable information across multiple user tiers, from job applicants and active substitutes to internal corporate staff.

The compromise of Substitute Teacher Service, Inc.'s network exposed a perilous combination of sensitive data categories, each carrying severe downstream risks for affected individuals. Exposed records commonly include full names, dates of birth, Social Security numbers, banking and direct deposit details provided for payroll purposes, and background check reports containing criminal or employment history. When Social Security numbers and banking details are leaked, victims face an immediate and prolonged threat of financial account takeover, unauthorized credit applications, and tax fraud. Furthermore, the exposure of background check data and employment records compromises the personal privacy of educators who trusted the agency with their most confidential credentials.

As an entity handling sensitive personnel and educational data, Substitute Teacher Service, Inc. was bound by stringent legal obligations under state data protection laws, common law negligence standards, and applicable federal trade commission guidelines. These legal frameworks mandate that organizations collecting personally identifiable information implement robust administrative, technical, and physical safeguards—such as multi-factor authentication, network segmentation, robust encryption protocols, and regular vulnerability assessments—to prevent unauthorized access. The occurrence of a data breach strongly suggests a failure in these foundational security duties, indicating that the company may have neglected to maintain reasonable and appropriate cybersecurity measures commensurate with the sensitivity of the data entrusted to them.

Receiving a data breach notification letter from Substitute Teacher Service, Inc. is a formal acknowledgment that your private information was compromised due to inadequate corporate security. Legally, the receipt of this notice establishes standing to participate in a class action lawsuit aimed at holding the company accountable for its security failures. Affected individuals do not need to wait until they experience actual financial fraud or out-of-pocket losses to seek legal recourse; the increased risk of identity theft alone is sufficient. Our law firm is investigating this breach on a contingency fee basis, meaning there are never any out-of-pocket costs or fees unless we successfully recover compensation on your behalf.

See every breach reported in Maryland or read what to do after a ransomware attack.