Bethany Roberts, FISM News

[elfsight_social_share_buttons id=”1″]

Ransomware attacks impacted 954 schools in 2021 alone, potentially affecting more than 950,000 students’ data, according to a study by security firm Comparitech. The firm estimates that these attacks have cost schools more than $3.5 billion in downtime.

Ransomware is a type of malware that threatens to either publish a victim’s data or make it inaccessible until a ransom is paid – the demands aimed at academic institutions have ranged anywhere from $100,000 to $40 million. Few schools have disclosed whether they paid the ransoms, but at least one school admitted to paying $547,000, according to Comparitech.

These costs increase when you consider data recovery, system upgrades, and the restoration of computers. While most schools have recovered, some had to shut down due to the impacts. Unfortunately, institutions that pay the ransoms are especially reluctant to report the attacks.

The reluctance to report the attacks has made gathering precise information on ransomware attacks almost impossible. The increasing lack of transparency in data breach reports creates a considerable risk factor for organizations and their consumers, according to the Identity Theft Resource Center (ITRC). 

367 cyberattacks were reported in the first quarter of 2022; however, nearly 50% of these reports lacked details about the cause of the breach.

The available data suggests there have been 270 ransomware attacks on schools between January 2018 and mid-May 2022, according to Comparitech, potentially impacting more than 3 million students and nearly 4,300 institutions.

At least $2.64 million in ransom payments has been collected by hackers – the average payment totaling $239,733. In addition to this, an estimated $20 billion will be spent on downtime costs to recover from the attacks.

Ransomware attacks on schools hit their peak in 2019 when 96 were reported.  Only 10 attacks had been reported in 2018. Attackers have seemingly narrowed their focus to school districts that are known to have large budgets. One such district is Broward County in Florida – of which hackers demanded $40 million in ransom. Though the district attempted to negotiate, the hackers ended up dumping nearly 26,000 files online.

“While hackers may be becoming more targeted in their approach,” Comparitech wrote in its report, “the lower downtime figures suggest schools are more prepared for these attacks and are better able to restore their systems from backups or mitigate the effects of the attacks.” 

Over time, ransomware has grown in complexity and cleverness. The first ransomware attack in 1989 was executed via floppy disks, but as technology has advanced, so has the criminal application of it. 

Employers, employees, clients, and others should be educated on The Hidden Costs of Ransomware report findings, laid out below:

• 50% of ransomware demands are for more than $50,000
• 50% of victims are being deceived by a website email link or attachment
• 46% of businesses say their clients were also impacted by the attack
• 45% of victims are unaware of the infection for more than 24 hours
• 38% of businesses say the attack harmed their brand or reputation
• 17% of victims were unable to recover their data, even after paying the ransom

Education and awareness of cyberattacks are critical in the effort to prevent them.  Proactive rather than reactive approaches have proven to be the most effective in managing these threats. It is important that companies, schools, and other organizations train their employees and consumers about the risks of cyberattacks and how to prevent them.