CHICAGO (AP) — Chicago Public Schools says the personal information of more than a half-million district students and staff was compromised in a ransomware attack on a district vendor last December.

CPS said Friday the data breach occurred Dec. 1, but CPS was not notified by technology vendor Battelle for Kids until April 26 that a server used to store student and staff information had been breached and four years’ worth of records were accessed.

CPS says that in total, 495,448 student and 56,138 employee records were accessed from the 2015-16 through 2018-2019 school years.

CPS says the breached server included names and identification numbers but did not include Social Security numbers, financial information or standardized test scores.