Rhysida ransomware group claims major cyber attack on Maryland's Prince George's County school

The notorious Rhysida ransomware group has claimed responsibility for a major cyber attack on Maryland-based Prince George’s County school’s systems.

Maryland-based Prince George’s County Public Schools is overseen by the Maryland State Department of Education and is one of the 25 largest school districts in the US. Earlier this month, the school district posted on social media that it was working to restore services following a broad network outage.

“Email and other services may be unavailable. Our team is working diligently to restore the network and we appreciate your continued patience. Updates will be provided as needed,” the school district said on 14th August.

In another post published the following day, the District said that on 14th August, it suffered a cyber attack that resulted in a network outage and enabled cyber criminals to access the user accounts of about 4,500 individuals.

“PGCPS experienced a cyber attack on the system’s network that was detected early Monday morning, Aug. 14. An estimated 4,500 user accounts out of 180,000 were impacted, primarily staff accounts,” the District said.

Recently, the infamous Rhysida ransomware group claimed responsibility for the cyber attack on the school district. According to security researcher Dominic Alvieri, the ransomware group on August 25 gave the school district a deadline of six day to meet its ransom demand of 15 Bitcoin or roughly 390,000 US dollars.

The group threatened to publish the stolen data if the District fails to meet its demands. The group hasn’t clarified the nature of the data stolen from the Prince George’s County Public School System, but has confirmed that it is in possession of sensitive personal data including passports, driver’s licenses, and more.

“With just seven days on the clock, seize the opportunity to bid on exclusive, unique, and impressive data. Open your wallets and be ready to buy exclusive data. We sell only to one hand, no reselling, you will be the only owner!” the group said.

In a recent update on its website, the school district said it has worked round the clock to get its systems back online and “continues to thoroughly investigate the cyber attack that disrupted network servers.”

Acknowledging the reports of the data leak, the district said, “We have learned that some personal information may be released online by those responsible for the cyber attack. While we now know that this may include identification details, we do not yet know the full extent of information relating to you, or to others, that may be affected.

“We are taking steps to perform a detailed review of all data that may have been compromised to identify any sensitive information impacted by this event. Once this work is complete, we will move as quickly as possible to notify those whose information may be affected.

“With the detailed data review expected to take several weeks, we will offer all staff and students access to free credit monitoring and identity protection services through Experian to help guard against potential misuse of personal information. Enrollment information is forthcoming,” it added.