Ransomware attacks are one of the biggest threats of our time and are often combined with theft and leakage of victims' data . One of the targets of hackers (mainly ransomware gangs) in recent years has been schools , which means that children's data has been exposed online.
See also: Record breaches and hacks in American schools in 2020
NBC News collected and analyzed school records from dark web and found they were filled with children's personal data. In 2021, ransomware gangs released data from more than 1,200 U.S. K-12 schools. Some schools that were notified of the leaks appeared to be unaware of the problem.
Furthermore, even when schools overcome an attack, parents have little help when their children's data is exposed
Some of the data is personal, such as medical conditions or family financial statements. Other information, including social security numbers or birth dates, gives details about the children's identity.
Public school systems are less equipped (than private schools) to protect student data from cybercriminals, said Doug Levin, director of the K12 Security Exchange, a nonprofit organization that helps schools protect themselves from cyberattacks.
“I think it’s very clear right now that they’re not paying enough attention to how to make sure that data is protected, and I think everyone is confused and doesn’t know what to do when it’s exposed,” Levin said. “And I don’t think people understand exactly how big this exposure is.”
For more than a decade, schools have been a prime target for hackers who expose people's data, which they typically collect and sell to identity thieves. But schools have never had a clear legal mandate on what to do after hackers steal children's data.
The recent rise in ransomware has escalated the problem, as gangs post files on leakif victims don't pay the ransom. The average person may not know where to find these sites, but other criminals can easily find them and buy or gain free access to stolen data.
See also: Ransomware: Are you worried? Three key steps to protect yourself
In February, just a few months after Toledo Public Schools in Ohio was hit by a ransomware gang that released children's data, a parent said someone tried to get a loan using their child's name.
In December, hackers breached the Weslaco Independent School District near the southern Texas border. Staff immediately notified 48,000 parents and guardians of the breach. They followed the FBI’s advice not to pay the ransom demanded. In response, the hackers released stolen child data. One of the files still online is an Excel spreadsheet titled “Basic Student Information” that lists about 16,000 students. The list lists the children’s names and includes entries for their date of birth, race, Social Security number, and gender, as well as whether they are immigrants, homeless, financially challenged, and have been identified as potentially dyslexic.
Nine months later, the school community is addressing the issue.
The impact is not always clear
Ransomware gangs steal data from schools and publish it, but they may not disclose exactly what they have stolen and how much data they have kept for themselves. This means that schools do not know exactly what data has been stolen and exposed.
The problem is made even worse by the fact that many schools do not know all the information stored on all their computers and therefore may not realize the extent of the leak. There have been incidents where it was said that no specific data was exposed. However, files with this data were found online.
Sometimes children's data is exposed because it's in the possession of third parties. In May, hackers released files they had stolen from Apollo Career Center, an Ohio vocational school that works with 11 regional high schools. Those files included hundreds of pieces of data, which are still online.
See also: IBM: Grants to US schools to defend against ransomware attacks
Schools tend to store a lot of data about children (medical history, family status, etc.) and often don't have the money to pay for cybersecurity experts or services to ensure that this data remains protected.
Parents are quickly learning that they have to deal with these problems themselves. Schools may not even know if they have been hacked or if hackers have posted student information on the dark web. And the law does not provide clear guidance on what to do if a school is hacked.
This means that both parents and children can't do much to protect themselves from the possibility of criminals gaining access to their personal information.
Source: NBC News
