Ransomware Attacks Expose Sensitive Information of Students, Sparking Concern

In a distressing series of events, ransomware criminals have resorted to dumping children’s private files online following school hacks, leading to devastating consequences, including suicide attempts.

Amidst the leaked files, one student pleaded for assistance, recounting the trauma of encountering a former abuser at a Minneapolis school. Other victims shared experiences of bedwetting and tearful nights. Shockingly, complete sexual assault case details were among the 300,000 files released online after Minneapolis Public Schools declined to pay a $1 million ransom. The exposed data encompassed medical records, discrimination complaints, Social Security numbers, and contact information of district employees.

The extensive digitalization of data in educational institutions has made them attractive targets for cybercriminals, who diligently seek out and acquire sensitive files that were once securely stored in locked cabinets. Ian Coldwater, a cybersecurity expert with a child attending a Minneapolis high school, remarked, “In this case, everybody has a key.”

School districts, often struggling financially, are ill-prepared to defend against or effectively respond to such attacks, especially as they grapple with the aftermath of the pandemic and shrinking budgets. Despite the promise of informing individual victims, administrators in Minneapolis failed to deliver, and unlike hospitals, there is no federal law mandating schools to provide such notifications.

The repercussions of school ransomware attacks extend beyond closures, recovery costs, or increased cyberinsurance premiums. The primary impact lies in the emotional trauma endured by staff, students, and parents due to the exposure of private records on the open internet and dark web.

Brett Callow, an analyst at cybersecurity firm Emsisoft, expressed concern about the alarming volume of information being posted online without proper scrutiny or public acknowledgment. Recent data breaches in major districts like San Diego, Des Moines, and Tucson have faced criticism for delayed admissions and notification processes.

In terms of cybersecurity measures, school systems have been slower to fortify and segregate their networks, encrypt data, and implement multi-factor authentication compared to other targets of ransomware attacks.

Estimates suggest that over 5 million U.S. students have been affected by ransomware incidents thus far, with a projected increase in district attacks this year. According to the Center for Internet Security, nearly one in three U.S. districts experienced breaches by the end of 2021.

Parents have prioritized alternative uses for limited funds, such as hiring bilingual teachers or purchasing new sports equipment, leaving cybersecurity measures underfunded. Incidents involving data theft have become common, with stolen information frequently sold on the dark web.

The criminals responsible for the Minneapolis theft took an exceptionally aggressive approach, sharing links to the stolen data on various platforms, including social media and the dark web. They even posted a handwritten note naming students involved in sexual abuse complaints on a video-sharing platform.

The Los Angeles Unified attack, orchestrated by a cybercrime syndicate, resulted in the release of 500 gigabytes of stolen data on the dark web leak site. This data included financial records and personnel files, compromising scanned Social Security cards and passports.

The exposure of psychological records or sexual assault case files with students’ identities can have severe psychological and professional consequences, potentially causing long-lasting damage to individuals. Despite the gravity of these breaches, school districts often receive advice from incident response teams that prioritize legal liability concerns and ransom negotiations over transparency.

Minneapolis school officials adhered to this guidance, initially describing the attack as a “system incident,” then as “technical difficulties,” and later as an “encryption event.” The true extent of the breach only became apparent when the ransomware group posted a video of the stolen data, giving the district a deadline to pay the ransom before leaking the files.

Amidst the COVID-19 pandemic, districts allocated funds to internet connectivity and remote learning, neglecting security measures. Software investments aimed at monitoring student engagement and performance often took precedence over privacy and safety concerns.

A survey conducted by the Consortium for School Networking found that only 16% of districts had full-time network security staff, with nearly half allocating 2% or less of their IT budgets to security. Moreover, the shortage of cybersecurity talent in the public sector makes it challenging for districts to retain qualified professionals.

With limited cybersecurity funds available, schools can only expect a fraction of the $1 billion in cybersecurity grants distributed by the federal government over four years. State-level grants and programs also aim to address cybersecurity gaps in schools but face significant challenges due to budget constraints.

As students’ private information remains exposed online, parents and teachers continue to express frustration and anxiety. The need for enhanced cybersecurity measures in schools is evident, but the financial implications and competing budgetary priorities pose significant obstacles to implementation.

The mother of one of the Minneapolis students whose confidential sexual assault complaint was released online feels violated and disturbed by the lasting consequences. The private information they held dear has been compromised and available to the public for an extended period.

Frequently Asked Questions (FAQs) about Ransomware attacks

More about Ransomware attacks

• Ransomware Attacks: Definition and Overview
• The Growing Threat of Ransomware Attacks on Schools
• Cybersecurity Best Practices for Schools
• Data Breach Response Guide for Schools
• Protecting Student Data Privacy
• Federal Cybersecurity Grant Program for Schools
• The Impact of Ransomware Attacks on Students
• Addressing the Cybersecurity Gap in Schools