Arizona Schools Ransomware Attack: Recovery Update

Students returned to Flagstaff (Arizona) Unified School District (FUSD) schools on September 9 following a ransomware attack that forced 15 schools serving more than 9,600 students to close on September 5 and 6.

The ransomware attack, which infected multiple district servers, was first discovered on September 4. District officials reportedly worked over the weekend to try to secure its Internet-facing systems and assess damage from the cyber extortion. The infection involved some 2,000 devices, reports said. Security personnel from a local Community College and other organizations are helping the school district’s internal security team, according to the Arizona Daily Sun. The district didn’t say if managed service security partners had also been called in to help with the recovery process.

At this point, the hackers have not been identified, nor are they likely to be, based on previous ransomware attacks on schools. District Technology director Mary Knight confirmed that the hackers had left a ransom note that did not demand a specific dollar amount to unlock the district’s systems. Instead the kidnappers left a note inviting the school district to negotiate with them. Knight told the Arizona Daily Sun that the district would not haggle with the crooks.

Ransomware Attacks Arizona Schools: The Recovery

To isolate the infection, which involved the school district's Windows-based systems, officials removed the servers and clients from the network. Teachers and district employees relinquished their systems so they could be examined for malware and new anti-virus software installed. As a result, the district had to close the affected schools until its business systems and back-ups were up and running. In the meantime, staffers used the middle school's library secured computers.

"If we don't do this, we're at risk of re-infestation because there could be a contaminated machine that, when they turn the system back on, could cause us to lose all the work that we've done in the last couple of days," Superintendent Mike Penca said.

While school districts may not seem to be lucrative targets for hackers, they are increasingly targeted as the low hanging fruit for unsophisticated cyber crooks scanning the internet. Under-resourced school districts may have outdated systems easy to ransom for money and data. Flagstaff is the latest in a string of ransomware hits on school districts in recent months. Other noteable attacks have hit school districts in Louisiana, New York, Oklahoma and Virginia. And, that may be just the beginning.

Some battles so far: (via The Hill)

While the war so far is one-sided in the cyber kidnappers’ favor, state governments have begun to fight back:

MSPs Also Suffer Ransomware Attacks

MSPs have also suffered ransomware attacks in recent months. The fallout has included:

Hackers worldwide have been hitting MSPs of all sizes — not just global technology service providers. The FBI and U.S. Department of Homeland Security have repeatedly warned MSPs and their technology platform providers about such attacks.

Amid those challenges, the MSP industry (spanning technology companies, service providers and more) could soon face a “crisis of credibility” if the market doesn’t take major steps to more effectively mitigate ransomware threats, cyberattacks and associated fallout, ChannelE2E and MSSP Alert believe.

In response, MSP software providers and their channel partners are increasingly activating two-factor authentication as a means to stop hackers from entering systems.

Additional insights from Joe Panettieri.