The Education Sector’s Harsh Lessons in Ransomware

By Chance Trammell

Recent headlines confirm a troubling trend within the United States: ransomware attacks on educational institutions are on the rise with tragic consequences. What all of these attacks have in common is a need to fortify defenses against potential ransomware attacks. 

Last fall, The Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the Multi-State Information Sharing and Analysis Center (MS-ISAC) released a joint Cybersecurity Advisory (CSA) as part of an ongoing #StopRansomware effort due to a notable rise in bad actors disproportionately targeting the education sector with ransomware attacks.

While not alone in this trend, a recent incident involving the Southern Valley School District in Nebraska serves as a stark case study in the critical nature of these attacks and the urgent need to improve cybersecurity measures before an attack occurs. A small school district, Southern Valley was ill prepared to meet the challenges of a an orchestrated attack by an elaborate hacker group which encrypted all of the district’s data and held it captive. The already financially burdened school district refused to pay the ransom demand and instead tried to find an alternative solution. This refusal to pay resulted in an escalation of chaos: the critical systems of the school district were entirely disabled, effectively halting all normal operations such as payroll, financial management, attendance records, student registration, and an access to online learning materials. The hackers, frustrated by the school's refusal to pay, leaked huge amounts of sensitive student, such as social security numbers, medical records, and student therapy notes, as well as staff information onto the dark web. 

Ultimately, the school district's decision to conserve their funds and not pay the ransom could end up costing them far more than the original ransom amount. The financial implications include the cost of recovery efforts, cybersecurity upgrades, potential lawsuits, and legal fees.

The consequences of these attacks extend far beyond financial concerns. "Confidential documents stolen from schools and dumped online by ransomware gangs are raw, intimate and graphic. They describe student sexual assaults, psychiatric hospitalizations, abusive parents, truancy — even suicide attempts," according to this article. These attacks have a devastating emotional impact on the school’s students, staff, and communities. 

These incidents underscore the critical need to fortify defenses against potential ransomware attacks. The Federal Bureau of Investigation (FBI) Cyber Division recommends the following mitigation strategies: 

  1. Keep System Up to Date: regularly patch known vulnerabilities, update end-of-life software, and automate software security scanning and testing
  2. Raise Awareness: implement training for students and faculty on phishing scams and avoidance of suspicious website, links and attachments,
  3. Strengthen Authentication: require strong, unique passwords, and enforce multi-factor authentication for all critical services
  4. Reduce Credential Exposure: limit accounts where credentials can be used and enable local device credential protection features
  5. Monitor Network Activity: use tools to detect abnormal activity and employ anomaly detection for unusual traffic patterns
  6. Enforce Least Privilege: clearly define and narrow account privileges and audit them against user patterns
  7. Secure Remote Access: limit access, monitor remote access/RDP logs, enforce account lockouts, properly configure devices, and disable unused ports

Preserving trust in the education sector and other critical institutions is of utmost importance. By allocating resources to enhance prevention and response capabilities, organizations can bolster their resilience against ransomware attacks. Safeguarding digital infrastructure and sensitive data paves the way for a stronger and more robust cybersecurity posture.