Two Illinois school districts disclose data breaches claimed by ransomware gangs
Two school districts north of Chicago this week confirmed they notified thousands of people about data breaches claimed by ransomware gangs, according to public disclosures.
Community High School District 117 says it notified 18,830 people about a June 2024 data breach. Ransomware gang BlackSuit claimed responsibility.
“We recently discovered unauthorized access to our network between approximately June 2 and June 12, 2024,” says District 117’s notice (PDF) to victims.
In a separate cyber attack, Crystal Lake Elementary District 47 says it notified 14,207 people about an October 2024 data breach. Ransomware gang RansomHub claimed responsibility for that attack in December, saying it stole 600 GB of data.
“On October 17, 2024, District 47 experienced a network disruption that affected certain district systems,” says District 47’s notice to victims. “Following a full and thorough investigation, we learned that certain information may have been accessed by an unauthorized third party in connection with this incident.”
Neither district has verified the claims of its alleged attackers. The schools did not publicly disclose what personal info was compromised, or whether that info belonged to students or staff. We do not know if either district paid a ransom, how much BlackSuit or RansomHub demanded, or how attackers breached the schools’ networks. Comparitech contacted school district officials for comment and will update this article if they reply.
Both schools districts are offering eligible victims free credit monitoring services, which usually implies information that could be used for identity theft, such as Social Security numbers, were compromised.
Who is BlackSuit?
BlackSuit first emerged in April 2023, and has a history of attacking critical industries like healthcare, government, and education. It’s a private operation and doesn’t employ a ransomware-as-a-service business model. BlackSuit often extorts victims twice: once for the decryption key to restore attacked systems, and again in exchange for not selling or publishing stolen data. The group has Russian lineage but hasn’t been attributed to a specific country.
BlackSuit has claimed 60 confirmed ransomware attacks, 12 of which were on targets in the education sector.
Who is RansomHub?
RansomHub runs on a ransomware-as-a-service model in which affiliates pay to use the group’s malware and infrastructure to launch their own attacks and collect ransoms. RansomHub is behind high-profile attacks on Rite Aid, Christie’s auction house, Frontier Communications, and the Florida Department of Health. It first started posting organizations it hacked to its leak site in February 2024.
RansomHub has claimed responsibility for 100 confirmed ransomware attacks, compromising more than 5.6 million records. Its other recent victims include All American Poly Corp, Lighthouse Electric Copany, and American Plumbing & Heating Corporation.
Ransomware attacks on US education
Ransomware attacks on schools, universities, and other educational institutions can force administrators to cancel classes until systems are restored. Ransomware can cripple systems used for grades, assignments, attendance, communication, payroll, and more. Many ransomware groups also steal data that can be used to later extort schools for even more money.
Comparitech researchers logged 69 confirmed ransomware attacks on US schools and universities in 2024, compromising 1.8 million records. The average ransom is $856,000.
We recently recorded four such attacks on Addison Northwest School District, the University of Oklahoma, Jefferson School District 251, and the Harrison County Board of Education. The attacks on Harrison County and District 251 forced their schools to cancel classes.
About Community High School District 117
CHSD117 is a 9-12th grade high school district based in Lake Villa, Illinois. It includes Antioch Community High School and Lakes Community High School. It currently enrolls 2,752 students as of time of writing.
About Crystal Lake Elementary District 47
Distrit 47 includes nine elementary schools, three middle schools, and one early childhood center in Crystal Lake, Lakewood, and the surrounding area:
- North Elementary School
- South Elementary School
- West Elementary School
- Husmann Elementary School
- Canterbury Elementary School
- Coventry Elementary School
- Woods Creek Elementary School
- Indian Prairie Elementary School
- Glacier Ridge Elementary School
- Richard F Bernotas Middle School
- Leon J Lundahl Middle School
- Hannah Beardsley Middle School
The district enrolls more than 7,000 students and employs more than 1,000 staff.
Source link
