Ransomware gang demands $1.4 million from Louisiana school district

Ransomware gang Rhysida is demanding $1.4 million from a southern Louisiana school district.

Rhysida yesterday claimed responsibility for an October 7, 2024 cyber attack on Vermilion Parish School System that forced schools in the district to take their computer systems offline. The cybercriminal group says it stole confidential data from the school, and it gave Vermilion Parish seven days to pay 15 bitcoin, worth about $1.4 million at time of writing.

If the school district fails to pay the ransom, Rhysida says it will auction off the breached data to other cybercriminals. To prove its claim, Rhysida posted a sample on its leak site of what it says are scans of stolen school district documents. The school district has not verified Rhysida’s claim.

We do not know if Vermilion Parish did or will pay a ransom, or what data Rhysida might have stolen. Comparitech contacted Vermilion Parish officials for comment and will update this article if they respond.

On October 7, 2024,  Abbeville High School, one of the schools in Vermilion Parish School System, posted about a “potential compromise” on its Facebook page.

“We want all to be aware that all Vermilion Parish School System networks and internet have been placed offline as we investigate a potential compromise of our systems. An expert team from Baton Rouge will be leading the inquiry and guide us on next steps. We feel like we caught the attack early but we want to be proactive in moving forward and prevent any further compromising of our system,” the post reads.

In another Facebook post, the school said networking issues caused its phone lines to go down. Those phone systems have since been brought back online.

Who is Rhysida?

Rhysida is thought to have ties to the ransomware group Vice Society and first surfaced in May 2023. Its ransomware can steal data and lock down targeted systems. It then demands a ransom both for deleting the data and for a key to restore infected systems.

Since it began operating, we’ve logged 63 confirmed ransomware attacks claimed by Rhysida, compromising 4 million records. Its average ransom is $1.25 million.

Rhysida’s other recent attacks on schools include those on Fylde Coast Academy Trust (UK) and Henry County Schools (TN).

Rhysida claimed another 91 unconfirmed attacks that were not acknowledged by targets.

Ransomware attacks on US education

Ransomware attacks on schools can lock down computer systems and steal confidential information stored on them. The attackers then demand a ransom in exchange for a key to unlock the infected systems and for not selling or publishing the stolen data. If they don’t comply, schools lose their data, spend months restoring their systems, and put their staff and students at risk of identity theft. The ransomware can affect access to student grades, staff payroll, library loans, lunch payments, and internet access in general.

Comparitech researchers tracked 58 confirmed ransomware attacks on US schools, universities, and other educational institutions in 2024. They include recent attacks on Winnebago Public Schools, Marysville Schools, Bartow County School System, Interboro School District, and Greater Lawrence Technical School 

About Vermilion Parish School System

Vermilion Parish School District consists of 20 schools in and around Abbeville, Louisiana. It enrolls 9,708 students, according to external sources.