FBI Warns the Public of Cyber Threats to School Districts

On October 30, 2017, I wrote a piece called Student Data in Schools the Target of Cyberattacks. Almost a year later, on September 13, 2018, the Federal Bureau of Investigation released a Public Service Announcement entitled Education Technologies: Data Collection and Unsecured Systems Could Pose Risks to Students. Whether you have heard of this or not, it is very important to understand and I will try to lead you through the circumstances that lead to this PSA from the FBI.

Now, before I go any further, if you work for or have a child currently or previously enrolled in Oak Grove School District, I want you to know that our IT department has been vigilant in keeping our security systems as up-to-date as we can based on current industry standards so that we can protect student and employee data. To date, I do not personally know of any malicious infiltration that has ever occurred within our systems. We also have started about three years ago a diligent effort to ensure that the education-as-service providers we use also protect student data to current industry standards - you can read about this effort and teachers' responsibilities in this effort in our blog post Student Data Privacy and Safety.

The FBI notice refers to a number of school districts in Iowa, Texas and Montana that were ransomed by cyber attackers in late 2017. The attackers stole personal information on students, families, and staff and then threatened to release the data unless payment from the district was received. In the process of making these threats they also threatened physical harm, and shamed and bullied students and parents through personal email, phone texts, and Facebook posts. This was announced by the United States Department of Education on October 16, 2017, titled ALERT! - CyberAdvisory - New Type of Cyber Extortion/Threat (the announcement has links to two news articles about the incidents).

Also mentioned in the FBI notice are two large EdTech companies, most likely Schoolzilla and Edmodo. In April of 2017, Schoolzilla was the subject of a white-hat hacker (someone who identifies weaknesses in a computer system and notifies the company about the vulnerability rather than exploiting it). This was reported in the online news source EdSurge and confirmed by Schoolzilla on their blog post: Our Commitment to Information Security. The second company was Edmodo. As reported on the Motherboard, over 77 million client records were captured and were being sold on the Dark Web (relatively secret locations on the internet where illicit activity occurs) for just over $1000. Luckily, Edmodo uses a difficult cryptology algorithm for its passwords, but it is unclear what other data might have been compromised, probably including over 40 million email addresses of students, parents and teachers.

These are just a few examples of the ways that school districts and EdTech companies have been targeted by cyber attackers. Since January 2016 (a mere two and a half years ago), there have been 370 reported incidents of security breaks at United States School Districts.

Though Oak Grove School District has not yet had an incident, the IT department remains ever vigilant to ensure that student and staff data remains secure, and the EdTech team seeks to constantly remind students and staff to use best practices with securing their accounts and passwords.

Student Data in Schools the Target of Cyberattacks

Whenever I go into classrooms and train students (and teachers), I try to emphasize the importance of being careful with your passwords. In fact, I have posted in this blog about password creation and safety multiple times. For many people that have been in education as long as I have (or longer) the question arises about why it is so important to keep our passwords and system safe - we're not handling nuclear material or doing things that will lead to people dying. The issue is that in today's world, data is one of the most powerful items that exists. The hacking of Equifax was so huge because of the numbers of people who had data stolen and the type of data that was stolen.

Schools are becoming a large target for cyberattackers. Why would this be? Is it the employees' data that attackers are attempting access? They are the ones with income and bank account. But that is not the reason - the real reason is student data. Recently, the Takeaway had a short segment on this danger titled Hackers Target Student Data as Schools Report Increasing Cyberattacks. You can listen to the segment below:

Student data represents a virtual gold mine to cyberattackers. With data contained within our School Information System, criminals would be able to start opening credit accounts in the name of students. Imagine your child reaching 18 years old, trying to open a credit card account, and being denied because they have over 10 years of bad credit history. That is what could happen if students' data is stolen. The worst part about this is that most parents will check their own credit on a regular basis, but will never think about checking their child's credit history. Thus criminals can have multiple years to abuse a child's identity without ever being caught.

In our district, the Information Technology department does our best to put in place protections to prevent cyberattackers from gaining access to our students' data. We have robust firewalls protecting our network, threat management software to detect and stop malware and viruses, and we limit access to our systems to verified users. A lot of companies employ such measures to make their networks and systems safe. Unfortunately, still many of them get attacked. One of the most common reasons systems get penetrated is user mistakes. What type of mistakes lead to this occurrence? People click on the wrong email and give over information or install software designed to infiltrate a system is on type of mistake, but the most common mistake is password security. Choosing a robust and difficult to guess password is the first step, as I've mentioned in previous posts. Using default passwords is essentially just as bad as having no password at all. Also, writing down passwords in publicly visible places - like a sticky note on your monitor or taped to your keyboard - is just as bad. No body should even need to know your password for any reason. If they have a valid reason for accessing your accounts, there are methods for system administrators to reset your password to get into your account. Remember, password security not only protects you, the teacher, but it also protects the data of your students.