Ransomware criminals leak children's private files after US school hacks

The confidential documents stolen from schools and dumped online by ransomware gangs are raw, intimate and graphic.

They describe student sexual assaults, psychiatric hospitalisations, abusive parents, truancy — even suicide attempts.

"Please do something," begged a student in one leaked file, recalling the trauma of continually bumping into an ex-abuser at a school in Minneapolis.

Other victims talked about wetting the bed or crying themselves to sleep.

Complete sexual assault case folios containing these details were among more than 300,000 files dumped online in March after the 36,000-student Minneapolis Public Schools refused to pay a $1 million ransom.

Other exposed data included medical records and discrimination complaints.

Rich in digitised data, the nation's schools are prime targets for far-flung criminal hackers who are assiduously locating and scooping up sensitive files.

Often strapped for cash, districts are grossly ill-equipped not just to defend themselves but to respond diligently and transparently when attacked, especially as they struggle to help kids catch up from the pandemic and grapple with shrinking budgets.

Months after the Minneapolis attack, administrators have not delivered on their promise to inform individual victims.

The Associated Press reached families of six students whose sexual assault case files were exposed. The message from a reporter was the first time anyone had alerted them.

"Truth is, they didn't notify us about anything," said a mother whose son's case file has 80 documents.

The lasting legacy of school ransomware attacks, it turns out, is not in school closures, recovery costs or even soaring cyber insurance premiums.

It is the trauma for staff, students and parents from the online exposure of private records — which the AP found on the open internet and dark web.

"A massive amount of information is being posted online, and nobody is looking to see just how bad it all is. Or, if somebody is looking, they're not making the results public," said analyst Brett Callow of the cybersecurity firm Emsisoft.

Doubly victimised

While other ransomware targets have fortified and segmented networks, encrypting data and mandating multi-factor authentication, school systems have been slower to react.

Ransomware likely has affected well over 5 million US students by now, with district attacks on track to rise this year, said analyst Allan Liska of the cybersecurity firm Recorded Future.

Nearly one in three US districts had been breached by the end of 2021, according to a survey by the Center for Internet Security, a federally funded nonprofit.

Just three years ago, criminals did not routinely grab data in ransomware attacks, said TJ Sayers, cyber threat intelligence manager at the Center for Internet Security.

Now, it’s common, he said, with much of it sold on the dark web.

The criminals in the Minneapolis theft were especially aggressive.

They shared links to the stolen data on Facebook, Twitter, Telegram and the dark web, which standard browsers can’t access.

The Minneapolis parents informed by the AP of the leaked sexual assault complaints feel doubly victimised.

Their children have battled PTSD, and some even left their schools. Now this.

"The family is beyond horrified to learn that this highly sensitive information is now available in perpetuity on the internet for the child’s future friends, romantic interests, employers, and others to discover," said Jeff Storms, an attorney for one of the families.

Despite parents' and teachers' frustration, schools are routinely advised by incident response teams concerned about legal liability issues and ransom negotiations against being more transparent, said Callow of Emsisoft.

Minneapolis school officials apparently followed that playbook, initially describing the February 17 attack cryptically as a "system incident," then as "technical difficulties" and later an "encryption event."

The extent of the breach became clear when a ransomware group posted a video of stolen data, giving the district 10 days to pay the ransom before leaking files.

The district declined to pay, following the standing advice of the FBI, which says ransoms encourage criminals to target more victims.

Security unprioritised

During the Covid-19 pandemic, districts prioritised spending on internet connectivity and remote learning.

Security got short shrift as IT departments invested in software to track student engagement and performance, often at the expense of privacy and safety, University of Chicago and New York University researchers found.

Cybersecurity money for public schools is limited.

As it stands, districts can only expect slivers of the $1 billion in cybersecurity grants that the federal government is distributing over four years.

Minnesota’s chief information security officer, John Israel, said his state got $18 million of it this year to divvy among 3,600 different entities.

State lawmakers provided an additional $22.5 million in grants for cyber and physical security in schools.