With the growing dependence of educational districts on technology for their operations, the occurrence of cyberattacks on K-12 schools is on the rise.
In the year 2023, there have been ransomware attacks on at least 48 districts, surpassing the total number recorded in the entirety of 2022. This data comes from Emsisoft, a cybersecurity firm. Of these attacked districts, all but 10 of them had their data stolen as well, as per the findings of the cybersecurity company.
The previous year saw ransomware attacks on educational institutions in the United States, including schools and colleges, resulting in nearly $10 billion in costs due to downtime alone.
The mechanics of these attacks are as follows: Hackers, frequently associated with Russia and China, employ network-encrypting malware to pilfer data. They achieve this by enticing unsuspecting teachers or school administrators to click on infected emails or attachments.
Once the virus gains access, it bars entry to the entire system's data, encompassing sensitive information like social security numbers, financial records, and confidential student data. To add leverage, the hacker often threatens to expose this information online unless they receive payment in cryptocurrency.
Comparitech's Editor and Consumer Privacy Expert, Paul Bischoff, highlighted the heightened vulnerability of schools due to the imperative nature of attendance. The regular functioning of the school system and the contentment of parents are jeopardized if children are forced to stay out of school for extended periods due to cyberattacks.
Bischoff clarified that hackers generally target fundamental information like names, addresses, and email addresses. While these details might not have an immediate monetary impact on students, they render them susceptible to future attacks, whether from sexual predators or thieves.
Recently, the Cleveland City School District identified ransomware on some of its devices. Thanks to proactive measures such as system backups, the level of disruption was contained.
However, there have been instances where other school districts weren't as fortunate. One Connecticut school district suffered a loss exceeding $6 million due to a cyberattack, although they have managed to recover roughly half of that amount.
In a notable case in March, ransomware groups made public 300,000 files after Minneapolis Public Schools declined to pay a $1 million ransom. These leaked files contained sensitive information about student sexual assaults, cases of psychiatric hospitalization, abusive parents, and even suicide attempts.
According to data from Comparitech, the year before saw 65 ransomware attacks affecting over 1,400 educational institutions, impacting around one million students. Although some hackers demanded ransoms ranging from $250,000 to $1 million, many schools refrain from disclosing ransom details due to concerns about attracting further attacks.
In a bid to address the issue, the White House organized its inaugural "cybersecurity summit" earlier this month.
Bischoff emphasized the necessity of training school staff to recognize phishing emails and other potential hacker entry points. He also advised ensuring that antivirus software is kept updated and that data is regularly backed up. He added that storing these backups off-site can safeguard them against ransomware attacks.
