Midlands School District Declines Ransom After Cyber Attack

Midlands school officials have announced their decision to reject a ransom demand from foreign hackers following a significant cyber attack that disrupted their computer systems and compromised sensitive student data. Superintendent Akil Ross disclosed this information during a virtual town hall meeting for parents held on Tuesday.

The cyber incident, which took place in June 2023, led to a series of operational challenges for the Lexington-Richland 5 district, including the delay of high school summer classes in the Chapin and Irmo areas. The attack also resulted in internet outages across district facilities for several days, affecting various administrative processes, including the disbursement of year-end bonuses to teachers and staff.

During the town hall, Ross explained that the district was aware of the breach early in the morning of the attack. “We knew at 6:30 a.m. that we had lost access,” he stated. Following the breach, the district activated its cybersecurity protocol, akin to a physical break-in, by alerting both law enforcement and the South Carolina Law Enforcement Division (SLED) to initiate an immediate investigation.

The superintendent did not disclose the specific amount of the ransom demanded by the hackers. However, a press release issued earlier this month indicated that personal information, including names, addresses, and Social Security numbers of some students, was posted on an online forum typically used by cybercriminals.

According to cybersecurity expert Jack Jupin, who participated in the town hall, the decision to refuse payment was prudent. “I tell my clients not to pay,” he advised. “Because if you pay, it just perpetuates the problem. They might come back six months later, hoping you’ll pay again.”

Jupin noted that the hackers, likely operating from China or Eastern Europe, were primarily motivated by financial gain rather than the personal data itself. “Most times, they’re not even looking at it,” he remarked. “This was an attack on your school district. They wanted the money.”

In response to the breach, the district plans to provide credit monitoring and identity theft protection for those affected, as well as all current staff members. Although the district does not currently have confirmation that all staff data is at risk, Ross emphasized the importance of these protective measures. Under state law, the monitoring will last for 12 months, with the possibility of extension if instances of stolen information are identified.

Ross highlighted the scale of the data breach, stating, “We’re going through over 1.03 terabytes of information. That’s 1,200 jump drives of data.” He confirmed that the costs associated with credit monitoring will be covered by the cybersecurity insurance held by the district.

Despite the robust security measures in place at Lexington-Richland 5, which had previously demonstrated strength in stress tests, the attack underscores the escalating threat of cybercrime targeting educational institutions. Ross explained that the breach occurred when an employee inadvertently opened a phishing email—an increasingly common tactic used by hackers to gain unauthorized access to systems.

As part of the ongoing investigation, local, state, and federal law enforcement agencies are involved, and Ross expressed caution in sharing details that could jeopardize the inquiry or reveal further vulnerabilities in the district’s systems.

During the town hall, community members raised concerns regarding their personal information. Jupin recommended that individuals contact major credit bureaus such as Equifax, Experian, and TransUnion to enhance monitoring of their financial activities. The district also encouraged the public to direct additional inquiries to their support channels as they work to address the fallout from this serious data breach.