News

Schools - target of Ransomware Attack

In 2020, 77 individual ransomware attacks affected over 1,740 schools and colleges, potentially impacting 1.36 million students. We estimate that these attacks cost education institutions $6.62 billion in downtime alone. Most schools will have also faced astronomical recovery costs as they tried to restore computers, recover data, and shore up their systems to prevent future attacks.

Over the last few years, ransomware attacks have become an increasing concern for schools and colleges worldwide. They take down key systems, shut schools for days on end, and prevent teachers from accessing lesson plans and student data. But what we did notice in 2020 was that while individual attack figures decreased quite significantly, the number of schools and students impacted by the attacks grew exponentially. This suggests hackers targeted larger school districts with bigger annual budgets, hoping to cause greater disruption and increase their ransom payment demands.

This trend looks as though it has continued in 2021, too, exemplified by the “bizarre” $40 million ransom request made to Broward County Public Schools in April.

So, what is the true cost of these ransomware attacks across the education sector in the US, how has the ransomware threat changed over the last few years, and what has happened in the first half of 2021?

Our team sifted through several different education resources—specialist IT news, data breach reports, and state reporting tools—to collate as much data as possible on ransomware attacks on US education providers. We then applied data from studies on the cost of downtime to estimate a range for the likely cost of ransomware attacks to schools and colleges. Due to the limitations with uncovering these types of breaches, we believe the figures only scratch the surface of the problem.

Key findings: In 2020:

• Ransomware amounts varied from $10,000 to over $1 million
• Downtime varied from minimal disruption (thanks to frequent data backups) to months upon months of recovery time
• On average, schools lose nearly 7 days to downtime and spend 55.4 days recovering from the attack
• Hackers received at least $1,909,058 in ransom payments
• The overall cost of these attacks is estimated at around $6.62 billion

Recently, many schools have been subject to double-extortion attempts where hackers not only lock them out of critical systems but steal data and threaten to post it online if the ransom isn’t paid. Recent examples include Somerset Independent School District, Union Community School District, and Affton School District.

WeSeSo News Analysis

There is a learning from the above report for Indian schools as well.

• With enactment of Private Data Protection Law, which is under discussion as PDP Bill with the Parliamentary Committee, all entities including schools will be obliged to disclose the sensitive data breach incident.
• Student’s, especially minor’s private data is of premium value for hard core cyber criminals.
• Any loss of data may face huge penalty and loss of reputation apart from the possible harm to the students
• Awareness about the cyber safety will be the most effective tool to prevent cyber crime in schools. Staff, students and parents – all will have to be made aware of the possible cybercrime.

WeSeSo Learning Foundation, a non-profit organization, aims to make a cyber-safe society with school students as the Agents of Change. If you find it useful then share it with others and help us secure the society because our motto is – We Secure Society.