The growing
ransomware threat
to school districts

A growing threat—but hard to quantify

Ransomware was responsible for 80% of malware-related incidents in the overall education sector in 2019, according to the 2020 Verizon Data Breach Investigations Report. That’s up from 48% the previous year.¹

The K–12 Cybersecurity Resource Center reported 62 ransomware incidents at K–12 institutions in 2019—a huge jump from 11 in 2018.² And the center notes that those numbers are almost certainly low.

Ransomware is notoriously underreported in all sectors. “The estimate is less than 10% is getting reported,” said Matthew O’Neill, Assistant Special Agent in Charge with the U.S. Secret Service, which investigates financial and electronic crimes.³

Reporting is low because many organizations prefer to deal with the problem quietly. We may learn about a larger percentage of cases involving public school districts because their boards have to meet publicly, and their challenges are often aired by the news media. Still, some K–12 cases likely go unreported.

Each of the 62 known attacks on school districts represents multiple individual schools. That means hundreds of schools and tens of thousands of students, teachers and other school employees were potentially affected.

The problem has become alarming enough that in July 2019, the U.S. Department of Homeland Security’s cybersecurity unit warned state and local governments that they should beef up their defenses against ransomware.

Why target school districts?

Anyone can potentially be a victim of ransomware, from individuals on home computers to hospitals to big businesses. Lately, cyberattackers have also been targeting school districts. Why target schools when much richer payoffs might be had by taking on, say, banks?

One reason is that school districts often don’t have the sophisticated defenses and resources of a bank. Schools often have older IT systems that are more susceptible to intrusion. They have limited time for training, leaving employees more vulnerable to phishing scams directed at email accounts. And they have hundreds of children using computers.

“They have limited budgets for computer security. It’s not something they think of before the fact,” said O’Neill.

They also have lots of valuable data—for instance, personally identifying information on students, families and staff that could be used to steal identities.

“That’s a prime target for any cyberattacker,” O’Neill said.

When they are attacked, schools usually have limited options for data recovery, leaving them more likely to succumb to a ransom demand. And they have a pressing need to remain open, as well as political pressure to respond quickly to fix the problem.

“They just want to be up and running,” the agent said.

The surge in distance learning in schools—with students and teachers sometimes using their own devices and connecting to school resources through home routers—has only increased districts’ vulnerability.

In publicly reported attacks in recent years on state and local governments, only about 17% paid the ransom.⁴

Who is behind the attacks?

Ransomware attackers can be lone wolves, but most of those who are targeting school districts or other large organizations are part of organized crime groups, O’Neill said.

By studying tactics, techniques and procedures used in an attack, investigators can often get a general idea of the type of group behind it. That doesn’t mean they can stop them, though.

Because attackers typically demand payment in untraceable cryptocurrency, such as Bitcoin, it’s difficult to establish attribution. Threat actors often live in countries beyond the reach of U.S. law enforcement, and they are continually evolving their techniques to try to stay one step ahead of law enforcement and cybersecurity experts.

How do they break in?

The main way cyberattackers get into networks is through phishing—using email to trick an employee into clicking on an attachment or link, which allows malware to be downloaded onto the network. Malicious PDFs can also be a source of malware.

Another avenue is Remote Desktop Protocol servers, which cyberattackers can break into through a brute-force attack or by buying credentials on the dark web. Attackers also take advantage of unpatched vulnerabilities in widely used applications such as Adobe® Flash,® Acrobat Reader® or JavaScript.®

Some victims do opt to pay, though, because the costs of recovery without a decryption key can greatly exceed the cost of the ransom. Also, they want to get back to business quickly. Many have purchased cybersecurity insurance, which helps cushion the costs.

The percentage of organizations worldwide purchasing cybersecurity insurance grew from 35% in 2011 to 75% in 2018.⁵

But do cyberattackers hold up their end of the bargain if you pay ransom?

Surprisingly, yes.

The cyberattackers run their organization as a business. “It’s almost like the bad actors want to provide this customer service of decrypting the data,” O’Neill said.

“They don’t want the reputation of having people pay the ransom and not getting their data back.” This is done to encourage other victims to pay the ransom.

That doesn’t take care of the problem, though.

They don’t pay up 100% of the time, and even when when they do, flaws in the encryption process can mean some data is lost.

Even if decryption is successful, districts will have more work to do.

They will need to rebuild servers, update computers and devices, and make certain the bad actors haven’t left a “back door” that allows attackers to come back in for a repeat visit. And they should assume the criminals made copies of their data.

“These cyberattackers … could have exfiltrated the data they’ve encrypted. So the decryption of a victim’s system doesn’t necessarily mitigate a possible data breach or the future monetization of the stolen data,” said O’Neill.

In fact, cyberattackers sometimes try to force the hand of victims who refuse to pay by threatening to publish their stolen data—which means that all sorts of sensitive data about students, teachers and other school personnel could wind up on the dark web.

Most common delivery methods and cybersecurity vulnerabilities causing ransomware infections according to MSPs worldwide as of 2019