Midlands School District Stands Firm Against Ransomware Attack

A significant cyber attack on the Lexington-Richland School District in South Carolina has led to a refusal to meet the demands of foreign hackers seeking a ransom. According to Superintendent Akil Ross, the district experienced a breach that compromised student data and disrupted computer systems, but officials opted not to pay the ransom demanded by the attackers.

During a virtual town hall meeting on Tuesday, Ross confirmed that the decision to reject the ransom request was made to prevent future attacks. Cybersecurity expert and former FBI agent Jack Jupin supported this decision, stating, “I tell my clients not to pay. Because if you pay, it just perpetuates the problem.” The attack, which occurred in June 2023, resulted in the delay of high school summer classes in both the Chapin and Irmo areas, as well as interruptions to internet access across district facilities.

When the cyber attack occurred, district officials were alerted to the breach at 6:30 a.m., prompting immediate action. “We have a cybersecurity protocol just as in the case of someone breaking into one of our buildings,” Ross explained. The district swiftly contacted law enforcement and initiated an investigation through the South Carolina Law Enforcement Division (SLED).

The hackers demanded an undisclosed amount of money, but the district has not revealed the specifics of the ransom. Earlier this month, the school district announced that sensitive data, including names, addresses, and Social Security numbers of some students, had been posted on an online forum frequented by cybercriminals. Jupin noted that the hackers were likely more interested in financial gain than the data itself, emphasizing, “This was an attack on your school district. They wanted the money.”

In response to the breach, Lexington-Richland 5 is offering credit monitoring and identity theft protection to those affected, as well as to all current district staff, despite not having confirmed that their information is at risk. By state law, this credit monitoring will last for a minimum of 12 months, with the possibility of extension if any stolen information is identified. The district is actively notifying those impacted as they analyze over 1.03 terabytes of data from the breach, equating to approximately 1,200 jump drives worth of information.

The costs associated with the credit monitoring services will be covered by the cybersecurity insurance held by the district. Ross highlighted that the school district’s existing security measures had previously passed stress tests, resulting in a reduction of their insurance co-pay from $100,000 to $25,000.

Despite this, the incident underscores a troubling trend, as attacks on educational institutions have surged in recent years, primarily due to the potential for quick financial returns. The breach occurred after an employee fell victim to a phishing email, a common tactic employed by attackers to gain unauthorized access to systems. Jupin noted that phishing attempts are rampant, even affecting his own security consulting firm.

Public concerns regarding the exposure of personal information were addressed during the town hall, with Jupin recommending that individuals contact credit bureaus such as Equifax, Experian, and TransUnion for enhanced monitoring of their financial transactions. The district has also encouraged community members to reach out with further questions as they continue to manage the aftermath of this cyber attack.

As the investigation proceeds, the Lexington-Richland School District remains focused on restoring its systems and ensuring the safety and security of its students and staff.