![\"\"](\"https:\/\/world.edu\/wp-content\/uploads\/2020\/12\/Cyberattacks.jpg\")
<\/p>\n<\/p>\n
Teachers in Baltimore County Public Schools knew something was wrong late in the day on Nov. 24 when they began to\u00a0experience trouble<\/a>\u00a0entering grades into the school district\u2019s computer system. Around the same time, the video for a meeting of the district\u2019s school board\u00a0abruptly cut off<\/a>.<\/p>\n Both situations were the result of a\u00a0cyberattack that had hit all of the school district\u2019s computer networks<\/a>, disrupting online classes for 115,000 students.<\/p>\n The episode was by no means isolated.<\/p>\n Rather, it was just one of several in an uptick of ransomware attacks in which cybercriminals have targeted public schools throughout the United States \u2013 from\u00a0Hartford, Connecticut<\/a>, to\u00a0Huntsville, Alabama<\/a>\u00a0\u2013 since the 2020-21 school year began.<\/p>\n Federal cybersecurity officials say the attacks \u2013 which involve things that range from the theft of sensitive student data to the disruption of online classes \u2013 are\u00a0expected to continue<\/a>.<\/p>\n As a\u00a0researcher<\/a>\u00a0who specializes in\u00a0cybercrime<\/a>\u00a0and\u00a0cybersecurity<\/a>, I know that public schools represent easy and attractive targets for cybercriminals.<\/p>\n This vulnerability is in part due to the fact that most schools\u00a0spend very little<\/a>\u00a0on cybersecurity, despite the fact that they need to perform a large amount of file sharing on their networks. They also may be likely to comply with cyberextortionists\u2019 demands because taxpayers and parents\u00a0expect them to restore networks quickly<\/a>.<\/p>\n Cyberattacks may not be completely avoidable, but there are steps school system leaders can take to reduce the likelihood that the attacks occur or that sensitive student data is stolen and leaked onto the dark web, as was\u00a0the case in Fairfax County, Virginia<\/a>, in October. But first, let\u2019s take a look at the scale and scope of the problem and how dramatically ransomware attacks increased between spring and fall of 2020, both in the United States and\u00a0globally<\/a>.<\/p>\n From March until mid-November, cybercriminals attacked U.S. school districts educating\u00a0over 700,000 students<\/a>. In the U.S., public K-12 schools represented about\u00a028%<\/a>\u00a0of all reported ransomware incidents from January to July. That figure more than doubled, to 57%, for August and September, when K-12 schools began the fall semester.<\/p>\n In Europe from July through August, the number of weekly cyberattacks against the education sector increased by\u00a024%, compared with 9% for all sectors<\/a>. During that same period, weekly cyberattacks targeting the education sector in Asia increased\u00a0by 21%, compared with 3.5% against all industries<\/a>.<\/p>\n Compared with most organizations and workplaces, public schools are\u00a0less prepared to defend themselves against cyberattacks<\/a>.<\/p>\n For instance, in\u00a0Baltimore County<\/a>, a state\u00a0government report<\/a>\u00a0indicated that the school system\u2019s network lacked adequate security and had failed to properly safeguard sensitive personal information.<\/p>\n Typically, public schools have\u00a0small IT teams<\/a>. Some have\u00a0technology leaders with no formal training in technology<\/a>.<\/p>\n Public schools also lack proper\u00a0data backup and recovery systems and procedures<\/a>.<\/p>\n Given the large number of users, school networks have many vulnerable points of entry and face higher risks of malware infection and transmission. Students might also use devices with outdated software, and their home networks might be insecure. If one student\u2019s device is attacked, that may be used as an entry point to attack the entire school network.<\/p>\n For instance, the criminals may send malicious email attachments to other users of the network using the student\u2019s credential. Most K-12 students\u00a0lack cybersecurity training<\/a>, which includes how to spot malicious links or infectious attachments.<\/p>\n Public schools are under pressure to ensure that students have access to online learning opportunities during the COVID-19 pandemic. The pressure to quickly restore networks is especially acute after the school year starts. Cybercriminals are\u00a0taking advantage of this situation<\/a><\/p>\n After penetrating a school network, the perpetrators seek to\u00a0gain privileged access and identify critical systems<\/a>. They then gather large numbers of account credentials, such as usernames, passwords and other items used to validate identity for authentication. They may also steal other sensitive data, try to destroy backups and disable security processes.<\/p>\n According to the antivirus company Emsisoft, after ransomware perpetrators compromise a network, they stay in the network for\u00a0an average of 56 days<\/a>\u00a0before they deploy ransomware.<\/p>\n Ransomware attacks against K-12 schools dramatically increased\u00a0when the 2020 school year started<\/a>. The number of universities, colleges and school districts facing ransomware attacks increased from\u00a0eight during the second quarter of 2020 to 31 during the third quarter<\/a>.<\/p>\n Sensitive personal data is also involved in such attacks. In\u00a0nine of the 31 ransomware incidents victimizing U.S. schools in the third quarter of 2020<\/a>, the perpetrators had stolen personal data. The five most active ransomware groups targeting K-12 schools \u2013 Ryuk, Maze, Nefilim, AKO and Sodinokibi\/REvil \u2013\u00a0run leak sites to \u201cdump\u201d personal data<\/a>\u00a0if victim schools refuse to pay.<\/p>\n In September, ransomware gang Maze attacked Ohio\u2019s Toledo Public Schools and published\u00a0personal data of faculty, staff and students<\/a>\u00a0online. Personal data posted on the dark web included students\u2019 and employees\u2019\u00a0Social Security numbers and dates of birth<\/a>. The criminals also disclosed information related to students\u2019 exam grades, disciplinary action and disability status. The identities of an eighth grader whom the school had listed as emotionally disturbed and a ninth grader suspended for sexual activity were revealed. A list of\u00a0foster children was also published<\/a>.<\/p>\n Among the most serious concerns in ransomware attacks against schools is that leaked children\u2019s data is likely to be sold in the dark web. Even before ransomware attacks started, children were\u00a051 times more likely <\/a>\u00a0to be targeted for identity theft than adults.<\/p>\n Some identity thieves specifically target children because the children may not find out that they were victimized until\u00a0decades later after applying for credit<\/a>.<\/p>\n The unique value of children\u2019s Social Security numbers also stems from the fact that they\u00a0lack a credit history<\/a>\u00a0and can be combined with any name and birth date.<\/p>\n School leaders should develop clear guidelines and policies to strengthen cybersecurity. Regular updates about\u00a0phishing<\/a>\u00a0and other threats, as well as strategies and instructions to mitigate and manage such threats, must be provided to students and staff.<\/p>\n Schools can also use free services to enhance cyberdefense. Of the\u00a013,000 school districts<\/a>\u00a0in the U.S.,\u00a0only 2,000<\/a>\u00a0are taking advantage of free membership in the Multi-State Information Sharing & Analysis Center. The center offers network vulnerability assessments, cyberthreat alerts and other services, such as\u00a0Malicious Domain Blocking and Reporting<\/a>, which prevents computer systems from connecting to malicious websites. Only\u00a0about 120 schools use the blocking service<\/a>.<\/p>\n Many school districts rely on outdated\u00a0equipment<\/a>\u00a0and\u00a0software<\/a>, which are easy to hack. It is important to patch operating systems and software when manufacturers release new updates. It also helps to constantly back up important data. By frequently backing up data and keeping it secure, schools can ensure the access to networks without disruption.<\/p>\n Schools may also want to purchase\u00a0cyberinsurance to defend against ransomware and other cyberthreats<\/a>. Insurance not only helps pay ransom, but it also helps to defend against attacks, because schools need to strengthen their security to get a lower premium. When online education company K12 Inc., which creates online learning curricula for over 1 million students, faced ransomware attacks in November, the company worked with its\u00a0cyberinsurer to make the ransom payment<\/a>.<\/p>\nAttacks have doubled<\/strong><\/h4>\n
Weak security<\/strong><\/h4>\n
Extortion tactics<\/strong><\/h4>\n
Children\u2019s data are highly valuable<\/strong><\/h4>\n
What can schools do?<\/strong><\/h4>\n