Connecticut special needs school hacked; student SSNs, finance, and medical info compromised

Waterford Country School this week notified an undisclosed number of people about a September 2023 data breach that compromised names, Social Security numbers, financial account info, medical info, health insurance info, driver’s license numbers, dates of birth, addresses, and student ID numbers.

Ransomware gang Inc claimed responsibility for the attack on January 29, 2024.

The school’s notice states, “Following an investigation conducted by third-party forensic specialists, it was determined the incident occurred between September 17, 2023, and October 5, 2023.”

For a limited number of victims, the compromised data also included passport info, biometric info, usernames, passwords, and/or payment card info.

The data puts students and other victims at risk of fraud, but the notice does not state that the school will offer them free credit monitoring or ID theft protection, as is the status quo following an incident like this one.

Waterford Country School has not verified Inc’s claim. We do not yet know how attackers breached its network, how much ransom was demanded, or whether the school paid the ransom. Comparitech contacted the school for comment and will update this article if it responds.

Who is Inc Ransomware?

Inc Ransomware emerged in July 2023 and targets a wide range of victims in healthcare, education, and government. Its methods involve spear phishing and exploiting known vulnerabilities in software.

Comparitech researchers logged 46 confirmed ransomware attacks claimed by Inc since it began operating, affecting more than 1.2 million records. It claimed another 110 attacks that have not been confirmed by victims.

Inc is responsible for seven other ransomware attacks on US schools and colleges, plus one in the UK. Its education targets include the New York School of Interior Design (18,491 records) and Decatur Independent School District (9,558 records).

Ransomware attacks on US education

In 2024 so far, we’ve tracked 35 confirmed ransomware attacks on US schools and colleges, affecting 241,502 records. That figure is down from last year, which saw a total of 121 attacks affect 2,672,815 records.

The average ransom demanded from schools is $527,000.

We recorded another 82 unconfirmed ransomware claims so far this year, six of which were made by Inc.

About Waterford Country School

WCS is a school in Connecticut for children with special needs and families at risk. Its programs include therapeutic boarding school, foster care, children’s therapy, summer camps, emergency shelter, and outdoor education. According to its website, the school has served 382 families, enrolls 82 students, and cares for 72 foster children.