Roughly 5,000 schools and colleges saw their websites go dark recently when a ransomware attack targeted Finalsite, a private company that provides webhosting and other communications services.
Finalsite works with 8,000 schools and colleges in more than 100 countries and is still looking into the Jan. 4 incident. A ransomware attack is when hackers breach an organization’s or an individual’s computer system and then demand payment to restore the system.
But at this point, seven days after the attack, “we have found absolutely no evidence that client data has been compromised or extracted,” said Morgan Delack, a spokeswoman for Finalsite, during a press briefing held on Zoom.
The incident, which impacted some 3,000 K-12 public schools in the United States, is more than just another example of how widespread a problem cybersecurity has become. It is also a stark reminder that school districts need to be thinking about not just their own data security systems, but those of the technology and education companies they work with, experts say.
“One of the things that we’ve seen in K-12 education is [increased] targeting of schools and districts for ransomware attacks,” said Amy McLaughlin, the cybersecurity director for the Consortium for School Networking, a group that represents chief technology officers in school districts. “And I think that we’re also starting to see an uptick in targeting of vendors who support K-12 schools and districts.”
The K-12 Cybersecurity Resource Center, a research organization, found 408 publicly disclosed cyberattacks against K-12 schools or districts in 2020, an 18 percent increase over the previous year. The center is still assembling data for 2021, said Doug Levin, the group’s national director.
And last year, district level education technology leaders ranked cybersecurity as their top concern for the seventh time in a row, in a survey released by CoSN.
These days, it’s not unusual for a school district to have two or three hundred technology vendors who help with everything from controlling the school bell schedule to running applications that teach kids math concepts, said Levin.
It’s a challenge for district leaders just to keep track of the shear volume of vendors, much less puzzle through questions like, “which ones are doing a good job with cybersecurity? What does that even look like? What requirements and standards should [vendors] be held to?” Levin said.
Finalsite continually monitors its networks and noticed ransomware the day the attack occurred, Delack said. The company took the “proactive” step of taking its system offline and rebuilding it again in a “clean environment,” she said. That’s why it took several days to get schools’ sites up and running again, she explained.
As of Jan. 10, schools are able to use the “bulk” of the company’s system, Delack said, and Finalsite is working to restore the remainder of its services.
Finalsite was able to figure out who hacked into its system and how they got in, Delack said. But she declined to identify the attacker or say whether the company—or its insurance provider—paid a ransom, citing the company’s ongoing investigation into the incident. She was also unable to share specifics on any next steps for possible legal action.
The investigation also prevented her from immediately sharing details about what Finalsite will do differently to protect itself and its clients going forward, she said. But once the inquiry is concluded, “we do fully intend on being as open as possible with our clients and the public about what we have learned” without compromising data security, Delack said.
An official in one district who Levin spoke to was frustrated that the district initially learned its site was offline through a website called “DownDetector” and not from Finalsite itself.
Not letting districts know right away that their websites were down because of an attack was a misstep on Finalsite’s part, Delack said.
“One area that we certainly have learned from the moment the websites went down universally, we should have sent a communication and we didn’t and we fully admit that that was not the right thing to do,” she said.
She said the company let its clients know about the attack once officials in the organization had time to connect and get a better sense of the problem. And since then, she said, the organization has been in regular touch with its clients, including providing a template for sharing information about the attack with parents.
“While there are some that have been dissatisfied with our response, there are dozens of others who are directly emailing us and publicly sharing their satisfaction with how we’ve handled the issue at hand,” Delack said in an email.
The incident “really highlights the importance of schools and districts knowing what the responsibilities of their vendor community are,” McLaughlin said. When buying services from a vendor, school districts should be sure they understand whether the company is backing up its systems and data. And they should know the vendor’s plan for restoring service in the case of an outage.
What’s more, in this particular case, school districts relying on Finalsite for webhosting needed to make sure they had a back-up communications plan, McLaughlin added. The flow of information from central offices to the public can be disruptedby a lot more than ransomware—there are floods, natural disasters, widespread power-outages, and other factors that can get in the way, too.
“Anytime you have a dependency for communications, you need to have an alternative,” McLaughlin said.
