Jefferson County School System loses access to Internet and phone lines following a ransomware attack

Jefferson County School System, the second-largest public school system in Alabama, US, suffered a significant cyber attack that disrupted its phone lines and internet services.

Jefferson County School System said via a notification posted on its website on April 1 that it suffered a ransomware attack during the Spring break and its IT teams took immediate steps to mitigate the impact of the attack.

The District involved third-party cyber security experts to investigate the security incident and notified law enforcement agencies. While the school district said that the preliminary investigation doesn’t show any evidence of sensitive personal information being compromised, the possibility of the same cannot be ruled out.

“We will continue to investigate any possibility of compromised data and notify stakeholders accordingly if discovered,” the District said.

The public school system also said that it has “multiple security protocols including filtering, firewalls, and antivirus systems” in place that detects such cyber attack and helps the District to mitigate the affect. However, out of an abundance of caution, it has taken its internal systems offline to investigate the situation better.

“While there will be a disruption of typical phone and internet service, schools will have access to phones for emergency communication. You should expect further updates as our investigation continues,” Dr. Walter B. Gonsoulin, the Superintendent of the District, said.

In February, Minneapolis Public School lso announced that it suffered an “encryption event” that affected internal IT systems and disrupted several systems including its internet, phones, cameras, badge access, printers, building alarms, and more.

On March 7, the infamous Medusa ransomware group listed Minneapolis Public Schools as its latest victim on its data leak site. The group said it gave the school district a deadline of March 17 to pay a ransom of $1 million in exchange for deleting all data or $50,000 to extend the deadline by another day. The group also said that it was willing to sell all stolen data to anyone willing to pay a million dollars.

Once the deadline was over, on March 17, the Medusa ransomware group published the data stolen from MPS. Ian Coldwater, a cybersecurity expert and an MPS parent, said that the leaked data included current and former student records, parent contacts, home addresses, IDs with pictures, grades, sensitive disciplinary and health records, budgets, contracts, grant information, building layouts, payroll and human resources information, and more.