Buffalo, New York; Broward County, Florida; and now, Los Angeles, California.
Across the United States, ransomware hackers are targeting schools at an unprecedented rate. In fact, 56% of the education sector experienced a school ransomware attack in 2021, according to a Sophos report. That’s nearly a 25% increase from the previous year.
In this guide, we’ll help you understand ransomware incidents and what you can do to prevent an attack on your school district.
A closer look at ransomware in school
Ransomware is a sophisticated variant of malware (i.e., malicious software). This type of attack infiltrates your school network or cloud domain and gains unauthorized access to sensitive data, personal information, and other critical files.
Even worse, ransomware hackers typically restrict access to that information so that you can’t retrieve the stolen data. Then, hackers either threaten to leak data to the public or hold the information ransom in exchange for payment.
How does ransomware impact your school district?
For some educational institutions, ransomware is a death blow. After suffering a cyber attack in December 2021, Lincoln College was forced to close its doors after 157 years in operation. The incident was a major disruption that took nearly four months to remedy. By the time the college regained access to its systems, enrollment had plummeted.
The story of Lincoln College is an extreme example of how devastating ransomware can be, but an important one to keep in mind. Generally speaking, a school ransomware attack has two outcomes:
- Ransom payment: Hackers on average request $2.47 million from the education sector, but some demands have been as high as $40 million. However, the average payment received is only $230,000 — still a major blow to any school’s budget. One Texas school district recently paid over $500,000 to ransomware hackers, claiming “there was no other choice.”
- Refusal to pay: If payment isn’t received, hackers may leak student data to the public or on the dark web, where there’s no telling who may access it or what they’ll do with the information.
For instance, in September 2022 a ransomware gang called Vice Society launched an attack against the Los Angeles Unified School District (LAUSD) — the second-largest district in the United States. With a goldmine of sensitive information in hand, the hackers demanded a massive ransom.
After the district announced it would not be paying the ransom, Vice Society released over 500GB of data online. According to Brett Callow, threat analyst at Emsisoft, the ransomware gang is responsible for at least eight other ransomware incidents.
Why your school is being targeted
Immediately after the LAUSD attack, the FBI issued a warning. Citing the frequency of ransomware incidents affecting the education sector, the FBI announced that attacks would likely increase in the upcoming school year.
However, the accelerated pace of ransomware has been a long time coming. In fact, school ransomware attacks hit an all-time high in 2020 with over 1,700 districts affected. So, what’s to blame for this emerging crisis?
According to the FBI’s warning, K-12 institutions may be seen as particularly lucrative targets due to the amount of personal data accessible through school systems or their managed service providers (i.e., cloud edtech vendors). Whether it be a student’s personal information or their parents’ financial information, school networks and clouds are loaded with highly valuable data.
What’s also important to note is that many school districts have a lackluster cybersecurity program. With limited funding, a shortage of physical resources and few staff members qualified for the job, most districts are ill-prepared to secure their data.
And with more schools leaning on cloud vendors, attack surfaces are starting to expand. An EdWeek report reveals that the vast majority of schools operate in the cloud using services like Google Workspace or Microsoft 365. That means they’re entrusting edtech providers and other third-party vendors with their sensitive data — adding yet another entry point into their system.
Worst of all, schools aren’t matching their cloud investments with cloud security. Only 20% of school cybersecurity budgets are allocated to safeguarding cloud-based data, per EdWeek. In other words, 8 in 10 schools are critically exposed to the threat of a cyber attack. If a ransomware gang like Vice Society launched a strike, they’d be nearly defenseless in the cloud.
Best practices for preventing ransomware attacks in your district
You know what ransomware is and how catastrophic it can be for your district — so what can you do to stop a ransomware gang in its tracks?
To help you out, let’s highlight a few best practices.
1. Prioritize cybersecurity spending
Educational institutions are among the slowest to implement a mature approach to cybersecurity. Typically, schools prioritize funding for other areas such as upgrading classrooms and facilities or recruiting teachers and staff.
But as cybercriminals become more daring and sophisticated as they target the education sector, it’s obvious that the status quo isn’t going to cut it for much longer. Schools need to prioritize cybersecurity spending, particularly as it comes to cloud security, which most districts tend to neglect.
2. Increase cybersecurity awareness and education
Teach students and staff how to recognize phishing attempts, how to be a responsible digital citizen, and whom it’s safe to share their information with online. In a nutshell, make sure your community understands why cybersecurity is important and what part they play in keeping the school district safe.
3. Enable 24/7 protection
Implement a solution that can stand guard over your data even when your security team is off the clock. Without a dedicated team of cybersecurity experts on staff, school IT departments struggle to keep up with thousands of students and their personal data.
Round-the-clock cloud security platforms like ManagedMethods watch over the cloud environment so that administrators can focus on other tasks.
4. Automate security workflows
Cybersecurity is a tall order for the average K-12 technology director. There are only so many hands to go around, which means cybersecurity is often a slow, manual, and tedious process. Inevitably, human error results in a critical vulnerability going undetected, which can expose the district to risk.
The right cloud security technology will automate workflows and streamline security, taking a major weight off your IT department’s shoulders. Multiply the power of your security team by automating important processes like risk detection and remediation.
5. Investigate anomalous activity
When strange behavior is identified, don’t make assumptions. Conduct a thorough assessment of the activity and get to the bottom of the threat before bad becomes worse.
That means you need to know exactly where the risk originated, which student or staff member is involved and where data has been shared. With ManagedMethods, that’s exactly what you get, allowing you to quickly organize the most effective response.
6. Remove unsanctioned apps from your cloud domain
Students may download cloud apps without express permission. Because the security of that app’s provider hasn’t been vetted or sanctioned by your technology team, you can’t guarantee that it isn’t a risk to your data. Even worse, it could be a malicious app created by a hacker to collect personal information.
ManagedMethods allows you to automatically detect unsanctioned apps and remove them from your cloud domain with just a few clicks (or automatically). That way, you can reduce risk and keep data under wraps.
7. Leverage an automated cloud security platform
ManagedMethods is designed specifically for Google Workspace and Microsoft 365, meaning it’s literally made to protect your cloud environment. Through automated risk detection and remediation, you can monitor your cloud domain and identify ransomware threats before they compromise your data.