Staunton Public Schools at ‘heightened level’ as ransomware attacks target educational sector

A ransomware attack on the second-largest school division in the country has had experts warning smaller school divisions to be on alert.

The attack used technology that encrypts data and generally won’t unlock until a ransom is paid. However, the Los Angeles school superintendent said no demand was made for money yet.

The division did detect the attack and was able to shut down many of its systems. According to published reports, it is unclear what might have been stolen or damaged in the breach.

Generally, if a ransom is not paid, the data gets released online and may contain sensitive passwords and data.

A school division in Albuquerque cancelled classes for 75,000 students in January after teachers were locked out of a database with student information due to a cyberattack. The system didn’t pay the ransom and eventually found a way to reset its systems.

Attacks of this nature can cost school systems millions of dollars due to hardware replacement and other expenses. Insurance may cover the financial loss to the school systems.

So far this year, more than 25 U.S. school districts and 24 colleges have been hit by ransomware attacks. According to a Pew Research survey published in August, 71 percent of Americans believe cyberattacks from other countries are a major threat to the United States.

A Cybersecurity Advisory alert was issued Tuesday by the Federal Bureau of Investigation, the Infrastructure Security Agency and the Multi-State Information Sharing and Analysis Center regarding the Vice Society (the alleged attackers in Los Angeles) in an effort to help organizations protect against ransomware.

According to the alert, the education sector has been a “frequent target of ransomware attacks” over the past several years.

“The FBI, CISA and the MS-ISAC anticipate attacks may increase as the 2022/23 school year begins and criminal ransomware groups perceive opportunities for successful attacks,” the alert read. “School districts with limited cybersecurity capabilities and constrained resources are often the most vulnerable.”

So, that begs the question, are local school districts prepared for a possible ransomware attack?

Staunton Public Schools director of technology Tom Lundquist said the Virginia Department of Education’s Office of Information Security has “provided educational opportunities for divisions to obtain instruction, threat management resources, contacts, and guides for troubles we may see or experience.”

He said the division is certainly aware of attacks happening nationally.

“In the constant wake of cybersecurity attacks, our awareness is and has been at a heightened level,” he said. “We continue our educational technology research and evaluate and test our selected implementations of adopted best practices to safeguard our data.”

In the joint advisory to #StopRansomware, the following actions were recommended to mitigate cyber treats and ransomware:

• Prioritize and remediate known exploited vulnerabilities
• Train users to recognize and report phishing attempts
• Enable and enforce multifactor authentication

If you or your organization is the victim of a network intrusion, data breach, or ransomware attack, contact your nearest FBI field office or report it at tips.fbi.gov.

For more information on cyber threats, visit fbi.gov/investigate/cyber