A ransomware attack against Baltimore County Public Schools has triggered a multi-day malware recovery effort, and schools will be closed on November 30 and December 1, district officials have announced.
Baltimore County Public Schools (BCPS) is the nation's 25th largest school district. BCPS educates more than 115,000 students in 175 schools, centers, and programs in Maryland.
The Baltimore county police department is working with the FBI and the Maryland Emergency Management Agency (MEMA) to investigate the ransomware attack. BCPS did not mention whether it has hired MSSPs (managed security service providers) or third-party forensics investigators to assist with the investigation and recovery. Also, the BCPS did not disclose the hackers' ransomware demands nor whether the district paid the extortion fee.
School districts remain prime targets for attack. Indeed, a September 2020 ransomware attack against Clark County School District (CCSD) in Las Vegas ultimately triggered a data breach involving Social Security numbers, student information and other private information.
Baltimore County Public Schools: Ransomware Attack Timeline
Here's a timeline of the Baltimore County Schools ransomware attack and associated recovery effort:
Baltimore County and Baltimore City: Background and Previous Attack
Baltimore County borders Baltimore City, but the two areas are separate municipalities, several readers point out. And while Baltimore County schools suffered a ransomware attack this time around, the city of Baltimore suffered its own RobbinHood (aka RobinHood) ransomware attack in May 2019.
Indeed, cybercriminals used RobbinHood (aka RobinHood) ransomware during the attack and demanded about $100,000 in Bitcoin to unlock hijacked files; they also shut down most of the city’s servers and some government applications.
Amid the fallout, the Baltimore Board of Estimates in October 2019 approved the city’s purchase of $20 million in cyber liability coverage. Baltimore officials previously discussed buying cyber insurance in August after cybercriminals launched a ransomware attack against the city earlier in the year.
Ransomware Attacks Target MSPs, IT Service Providers
Meanwhile, data center providers and MSPs remain prime targets for ransomware attacks, since their systems often host or interconnect to numerous end-customer systems. Many of the attacks involve stealthy approaches that hide from anti-virus tools, Huntress Labs recently reported.
The U.S. Secret Service has warned IT service providers and consulting firms about ongoing cyberattacks. The warning indicated that threat actors are increasingly targeting point-of-sale (POS) systems and performing business email compromise (BEC) and ransomware attacks.
Recent MSP and IT consulting ransomware attack victims include:
How MSPs Can Mitigate Ransomware Attack Risks: To safeguard your MSP business and clientele from ransomware attacks, follow this tip sheet.
