Ransomware Attacks Now Targeting School Systems

Ransomware attacks are nothing new. Thousands of businesses have fallen prey to malicious attackers for decades, paying billions in ransom and disrupting operations from a few days to a few months. And that number is only growing.

According to FortiGuard Lab’s 2021 Ransomware Survey Report, ransomware attacks have increased by almost 1,100% year-over-year. While we most often associate attacks with banks and mega-corporations, the truth is ransomware attacks are no longer for the enterprise only. K-12 and higher education institutions appear to be the latest victims, seemingly fueled by the 2019 COVID pandemic.

The COVID Impact on Ransomware Attacks

The COVID pandemic of 2019 disrupted our lives, how we learn, and our approach to work. As the world was forced to go remote, many organizations weren’t prepared for the shift to remote working and virtual learning. And neither were their security systems and teams.

The Information Systems Audit and Control Association (ISACA) explains how the threat landscape expandedwhen unprepared businesses and schools had to go remote to adapt to the pandemic. Employees, teachers, students, and consumers did everything remotely—shopping, teaching, learning, and working.

School systems became more digitally connected than ever before, using platforms like Zoom and Google Classroom to teach students virtually. And attacks like “Zoom-bombing,” where uninvited guests gain control of screens and disrupt classes, became more commonplace. With such a vast threat landscape, the vulnerabilities were virtually limitless.

The 2022 Labor Day weekend ransomware attack on the Los Angeles Unified School District (LAUSD)—the second-largest U.S. school district—is yet another example. Whether they’re attacking one of the largest districts in the country or a small, budget-challenged school district, school ransomware attacks spread far and wide. But the attacks are especially tough on smaller, poorer schools that lacked the resources and didn’t prepare for the immediate shift and technical requirements for remote teaching.

“School districts with limited cybersecurity capabilities and constrained resources are often the most vulnerable; however, the opportunistic targeting often seen with cybercriminals can still put school districts with robust cybersecurity programs at risk. K-12 institutions may be seen as particularly lucrative targets due to the amount of sensitive student data accessible through school systems or their managed service providers.” – FBI and CISA bulletin

But the LAUSD attack is far from the only educational institution impacted. The surge in ransomware attacks on schools has been so profound that President Joe Biden signed the K-12 Cybersecurity Act of 2021 into law to strengthen cybersecurity in schools. The act “directed CISA to work with teachers, school administrators, and private sector firms to develop recommendations and an online toolkit that can help schools improve their security, from securing student data to security challenges with remote learning.”

And after the LAUSD, the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) released a joint bulletinwarning of even further increases in attacks. That’s on top of the 1,000-plus educational institutions that have already suffered a ransomware attack since 2019.

Despite acts written into law and many warnings and bulletins, schools are still dealing with the ramifications of attacks by malicious actors.

The Implications of Ransomware on Schools

As the name implies, ransomware attacks use malware to “encrypt files on a device, rendering any files and the systems that rely on them unusable. Malicious actors then demand ransom in exchange for decryption. [They] often target and threaten to sell or leak exfiltrated data or authentication information if the ransom is not paid.”

Cybersecurity Dive, an online newsletter for news on cybersecurity, breaches, and threats, shared that, on average, higher education organizations reported average remediation of $1.42 million per attack. K-12 reported an even higher $1.58 million. While these financial payouts are a huge hit to schools, they’re not the only implication of ransomware attacks:

• Unauthorized access to personally identifiable information (PII). ISACA highlights unauthorized access to confidential information, such as names, addresses, social security numbers, and financial details as one of the most important factors to consider. If accessed by the wrong people (attackers), students (and teachers or staff) could become victims of identity theft. And schools may have lawsuits on their hands for not properly caring for the highly confidential and valuable information hackers accessed in the data breach.
• Delays, disruptions, and restricted access. The CISA security alert discussed some of the less critical but still impactful ramifications of data breaches within schools. These include restricted access to networks and data, delays in exams, canceled classes for the day, and downtime.According to a 2022 Sophos study of 730 IT professionals in the education sector, it takes twice as long to recover after an attack than with organizations outside of the education industry. Forty percent reported it taking more than a month, 31% said between one and three months, and 9% recovered between three to six months later.
• The new ransomware target. Education just might be the new prime target for ransomware attacks. The same Sophos study revealed that educational institutions were attacked even more in 2021 than the previous year, impacting nearly two-thirds of higher education organizations. And for K-12? Ransomware hit more than half of them. The attacks have many implications, but for higher ed, 97% of respondents said they impacted their ability to operate, which can have long-term effects, like permanently closing their doors.

How You Can Fight Back

While ransomware attacks aren’t going away anytime soon, whether you’re a 40,000-student college campus or a small rural school, there are ways to fight back. We also recommend working with a team of security professionals who can set up and continually monitor your network to help prevent and mitigate the effects of a data breach.

So, if you’re ready to combat malicious attacks, contact us today to see how Lightstream can protect your school’s data from breaches.