Data Security & Malware

District Pays Cyber Ransom as Business Decision

• By Dian Schaffhauser
• 09/19/19

A New York school district superintendent has gone public with some of the details of a ransom his school system paid earlier this summer to regain access to school systems. Rockville Schools and its insurance company paid $88,000 in bitcoin through a third-party negotiator. The original ransomware demand was for $176,000, according to Superintendent William Johnson.

In a television interview Johnson said the ransomware demand surfaced in late July when the district's director of technology found something wrong with his email and "pulled the plug" on the network.

While no data ever left the district, according to Johnson, all of the school system's data, telephones and programs became "totally unusable to us in any way whatsoever."

After communicating with local police, the Department of Homeland Security and the Federal Bureau of Investigation, the district called its insurance company, which put school officials "in touch with a person who was a negotiator on our behalf." Ultimately, according to an article in SC Magazine, the district paid $10,000 (the deductible) and the insurance company covered the rest.

While Johnson said that the district considered itself "safe," the particular group behind the Ryuk malware that was used in the incident had algorithms "that were far more sophisticated than anything we had ever seen."

The school system couldn't use backups because, as Johnson explained, the criminals encrypted that first "and then came into the operating system."

In spite of general warnings from the FBI not to pay ransoms in these kinds of situations, the district chose to do so as a business decision, Johnson said. "It was cheaper for us" than to try to recover or rebuild the systems anew.

School districts and local governments have been hard hit. New York's Mineola School District, Idaho's Nampa School District and Arizona's Flagstaff Unified School District have all been victims of ransomware attacks in recent months.