Rockville Center School District paid ransom of almost $90,000 for restoring their data

The officials said that Rockville Centre School District paid ransom of $88,000 in bitcoin, so as to regain access of the files on system's server that were encrypted by ransomware attack on Jul. 25, 2019. The school records were kept encrypted by hackers until the ransom payment has been received in mid-August.

William Johnson, Rockville Centre Superintendent, said that almost all of the payment has been covered by district's insurance. The Rockville Centre Superintendent added that the payment was necessary for restoring district's communications systems, along with other data required to run the day-to-day operations after cyberattack in the month of July. Johnson said that the district was attacked by Ryuk virus, which has been discovered by Mike Anderson (i.e. Director of Technology) on the morning of Jul. 26, 2019.

Anderson acted quickly and on time to stop the Ryuk virus from infecting the district files further, according to Johnson. The superintendent said that "he recognized there was a problem with email and shut down the entire system immediately. By acting as quickly and thoroughly as he did, he was able to limit the damage to our data files and emails".

Although the district has anti-virus software and firewalls, Johnson said, this Ryuk virus was successful in evading detection.

"Look, nobody wants to pay anything, but if they encrypted the files and I don't have access to them, it is difficult to run a school district without any historical data or emails, most of which were encrypted," said Johnson as published in newsday.com.

As per Johnson, the demand of ransom was reduced from $176,000 to $88,000 as the district was successful to shut down this cyberattack early in encryption process. The district has paid $10,000 deductible to their insurance company, and remaining ransom has been covered by their insurance policy.

The decision of paying the ransom demand was based on the evaluation of what would be the costing to recover from this cyberattack without decryption keys, and it was learnt that less expensive route was to pay the ransom.

Once the ransom has been paid, Johnson said that decryption tool was given. The administration and Board of Education will now work with the cybersecurity experts, Homeland Security and the FBI in the upcoming months for securing a more effective backup and antiviral system.

» SPAMfighter News - 9/13/2019