Scranton School District investigating major ransomware attack that caused a network outage

Scranton School District in Pennsylvania said it experienced a cyber security incident that forced it to take several of its systems offline and delay scheduled classes.

 

Located in the Wyoming Valley in Pennsylvania, Scranton School District serves the city of Scranton in Lackawanna County, with as many as two-thirds of its pupils living below the poverty line. As of 2022, the school district had over 9,000 pupils in its rolls and over 600 staff members. 

 

Earlier this week, the school district announced in a social media post, which was later taken down, that it experienced a ransomware attack that caused a major network outage.

 

“The attack is causing a temporary disruption to some of our computer systems and services. We are working diligently with third party forensic specialists, that we engaged last evening, to investigate the source of this incident, confirm its impact on our systems, and to restore full functionality to the system as soon as possible,” the school district said.

 

According to the Recorded Future News, the news of the cyber security incident first came to light last Thursday when the school district asked its students to report to their classes two hours later than usual.

 

“ATTENTION SSD STUDENTS: tomorrow, March 14, 2024 all students will operate on a two hour delay schedule. Staff is to report at normal time. Again, SSD students will operate on a two hour delay schedule. Staff is to report to their buildings at normal time,” Scrantion tweeted.

 

 

Later, local news agency Scranton Times-Tribune reported that acting Superintendent Patrick Laffey confirmed that the school district was targeted with a ransomware attack.

 

“Scranton School District’s computer system was recently hacked and infected with ransomware, according to acting Superintendent Patrick Laffey,” the news agency said.

 

Rosemary Boland, president of the Scranton Federation of Teachers, has asked all teachers and school staff to refrain from using any electronic devices connected to the District’s internal network and uninstall any school-related apps from their mobile phones.

 

“As you know, some files may be inaccessible during this period as we, and the third-party forensic specialists, continue the investigation. Due to the increased security measures placed in our systems, some functions may be slower than usual,” the school district explained.

 

The school district is yet to share details on who is behind the ransomware attack, whether threat actors exfiltrated any data from its internal network or if the district has received a ransom demand. The district’s website continues to be inaccessible.

 

“We are working diligently to investigate this matter with the assistance of third-party forensic specialists and intend to restore full functionality to our affected systems as quickly and securely as possible. We have significant resources devoted to this process and our work to resolve this issue is ongoing,” Laffey added.