Leadership Symposium Early Bird Deadline Approaching | Join K-12 leaders nationwide for three days of empowering strategies, networking, and inspiration! Discounted pricing ends March 1. Register today.
Privacy & Security

Thousands of School Websites Went Down in a Cyberattack. It’ll Happen Again, Experts Say

By Alyson Klein — January 10, 2022 4 min read
Special Report Cybersecurity
  • Save to favorites
  • Print

Roughly 5,000 schools and colleges saw their websites go dark recently when a ransomware attack targeted Finalsite, a private company that provides webhosting and other communications services.

Finalsite works with 8,000 schools and colleges in more than 100 countries and is still looking into the Jan. 4 incident. A ransomware attack is when hackers breach an organization’s or an individual’s computer system and then demand payment to restore the system.

But at this point, seven days after the attack, “we have found absolutely no evidence that client data has been compromised or extracted,” said Morgan Delack, a spokeswoman for Finalsite, during a press briefing held on Zoom.

See Also

Image of a red glowing caution sign over a dark field of data.
Getty
Privacy & Security Explainer School Cyberattacks, Explained
Alyson Klein, February 11, 2022
12 min read

The incident, which impacted some 3,000 K-12 public schools in the United States, is more than just another example of how widespread a problem cybersecurity has become. It is also a stark reminder that school districts need to be thinking about not just their own data security systems, but those of the technology and education companies they work with, experts say.

“One of the things that we’ve seen in K-12 education is [increased] targeting of schools and districts for ransomware attacks,” said Amy McLaughlin, the cybersecurity director for the Consortium for School Networking, a group that represents chief technology officers in school districts. “And I think that we’re also starting to see an uptick in targeting of vendors who support K-12 schools and districts.”

The K-12 Cybersecurity Resource Center, a research organization, found 408 publicly disclosed cyberattacks against K-12 schools or districts in 2020, an 18 percent increase over the previous year. The center is still assembling data for 2021, said Doug Levin, the group’s national director.

And last year, district level education technology leaders ranked cybersecurity as their top concern for the seventh time in a row, in a survey released by CoSN.

These days, it’s not unusual for a school district to have two or three hundred technology vendors who help with everything from controlling the school bell schedule to running applications that teach kids math concepts, said Levin.

It’s a challenge for district leaders just to keep track of the shear volume of vendors, much less puzzle through questions like, “which ones are doing a good job with cybersecurity? What does that even look like? What requirements and standards should [vendors] be held to?” Levin said.

Finalsite continually monitors its networks and noticed ransomware the day the attack occurred, Delack said. The company took the “proactive” step of taking its system offline and rebuilding it again in a “clean environment,” she said. That’s why it took several days to get schools’ sites up and running again, she explained.

As of Jan. 10, schools are able to use the “bulk” of the company’s system, Delack said, and Finalsite is working to restore the remainder of its services.

Finalsite was able to figure out who hacked into its system and how they got in, Delack said. But she declined to identify the attacker or say whether the company—or its insurance provider—paid a ransom, citing the company’s ongoing investigation into the incident. She was also unable to share specifics on any next steps for possible legal action.

The investigation also prevented her from immediately sharing details about what Finalsite will do differently to protect itself and its clients going forward, she said. But once the inquiry is concluded, “we do fully intend on being as open as possible with our clients and the public about what we have learned” without compromising data security, Delack said.

An official in one district who Levin spoke to was frustrated that the district initially learned its site was offline through a website called “DownDetector” and not from Finalsite itself.

Not letting districts know right away that their websites were down because of an attack was a misstep on Finalsite’s part, Delack said.

“One area that we certainly have learned from the moment the websites went down universally, we should have sent a communication and we didn’t and we fully admit that that was not the right thing to do,” she said.

She said the company let its clients know about the attack once officials in the organization had time to connect and get a better sense of the problem. And since then, she said, the organization has been in regular touch with its clients, including providing a template for sharing information about the attack with parents.

“While there are some that have been dissatisfied with our response, there are dozens of others who are directly emailing us and publicly sharing their satisfaction with how we’ve handled the issue at hand,” Delack said in an email.

The incident “really highlights the importance of schools and districts knowing what the responsibilities of their vendor community are,” McLaughlin said. When buying services from a vendor, school districts should be sure they understand whether the company is backing up its systems and data. And they should know the vendor’s plan for restoring service in the case of an outage.

What’s more, in this particular case, school districts relying on Finalsite for webhosting needed to make sure they had a back-up communications plan, McLaughlin added. The flow of information from central offices to the public can be disruptedby a lot more than ransomware—there are floods, natural disasters, widespread power-outages, and other factors that can get in the way, too.

“Anytime you have a dependency for communications, you need to have an alternative,” McLaughlin said.

Related Tags:

Events

Jobs Virtual Career Fair for Teachers and K-12 Staff
Find teaching jobs and other jobs in K-12 education at the EdWeek Top School Jobs virtual career fair.
This content is provided by our sponsor. It is not written by and does not necessarily reflect the views of Education Week's editorial staff.
Sponsor
Reading & Literacy Webinar
Science of Reading: Emphasis on Language Comprehension
Dive into language comprehension through a breakdown of the Science of Reading with an interactive demonstration.
Content provided by Be GLAD
English-Language Learners Webinar English Learners and the Science of Reading: What Works in the Classroom
ELs & emergent bilinguals deserve the best reading instruction! The Reading League & NCEL join forces on best practices. Learn more in our webinar with both organizations.

EdWeek Top School Jobs

Teacher Jobs
Search over ten thousand teaching jobs nationwide — elementary, middle, high school and more.
View Jobs
Principal Jobs
Find hundreds of jobs for principals, assistant principals, and other school leadership roles.
View Jobs
Administrator Jobs
Over a thousand district-level jobs: superintendents, directors, more.
View Jobs
Support Staff Jobs
Search thousands of jobs, from paraprofessionals to counselors and more.
View Jobs

Read Next

Privacy & Security A Massive Data Leak Exposed School Lockdown Plans. What Districts Need to Know
More than 4 million records held by school safety software company Raptor Technologies were left inadvertently exposed online.
5 min read
Concept image of security breach, system hacked alert with red broken padlock icon showing vulnerable access.
Nicolas Herrbach/iStock/Getty
Privacy & Security As Cyberattacks Mount, Lawmakers Double Their Efforts to Protect Schools
But the legislative push is not matched by funds to build better cyber defenses.
2 min read
Conceptual illustration of computer with a pixelated lock on screen.
Nanzeeba Ibnat/iStock/Getty Images Plus
Privacy & Security 3 Superintendents Share Cybersecurity Best Practices
Cyberattacks cause major disruptions to learning, but school districts are still struggling to put in place effective protections.
3 min read
Image of a red glowing caution sign over a dark field of data.
Getty
Privacy & Security Saturn Is a New App for High Schoolers. Here’s Why It Has Educators Concerned
Saturn is billed as a time-management app, but experts see potential privacy concerns in allowing it broad access to students' schedules.
6 min read
Image of a clock, calendar, and a pencil.
Tatomm/iStock/Getty