Interlock group stole over 600GB of student data from Adelaide school’s systems

The Interlock ransomware group said it stole over 600 GB of confidential information from the network of Adelaide-based Reynella East College, including students’ sensitive personal data.

The ransomware group announced its successful cyber attack on the school on June 23, approximately two weeks after the school notified parents about a major data breach incident that forced it to take its information technology systems offline temporarily. 
 
“There has been a cyber security breach impacting all of our school’s computer systems,” the school said in a notification sent to parents on June 9. “The Department for Education is working closely with our school and specialist teams to understand what has happened and restore systems as quickly as possible. It is unlikely our school’s ICT systems will be back online this week.”

The school did not explain the nature and scope of the cyber attack or whether student data had been compromised, but assured parents that the cyber security incident did not impact regular class schedules. 

On June 23, the Interlock ransomware group published a 600 gigabyte dataset which it allegedly stole from Reynella East College’s IT systems. It is unclear if the school refused to pay a ransom, but the publication of the stolen dataset points towards the hacker group’s failure to extract a ransom.

“The school failed to adequately protect the privacy of its students and staff and made no attempt to do so, resulting in the leak of their sensitive personal data online,” the hacker group wrote in its dark web leak site. “We are providing you with 600 GB of interesting files and documents, including contracts, financial reports, personal data, student and staff identification numbers, seating charts, and much more.”

Reynella East College has not responded to the hacker group’s claims and has not disclosed any information on how many students or staff members were impacted. Officially opened in 2013, the school has over 2,000 students in its rolls and employs 163 teaching staff and dozens of other staff members.

In its cyber incident notification posted on its Facebook page on June 9, the school said that its investigations into the incident were ongoing and it would provide further advice if it discovered any impact to personal information. No further updates have been shared by the school at the time of writing.