As the year comes close to its end, a new data collected by security firm Armor reveals that a total of 1,039 schools across the U.S. have been potentially hit by a ransomware attack since January this year.
According to the findings, 72 U.S. school districts and educational institutions have been victimized by ransomware in 2019 alone, in which 11 had their systems impacted only in October. These 11 new school districts, the company revealed, had directly affected 226 schools in total.
"Of the 11 school districts hit in this last attack wave, only 1 has reported having paid the ransom, but did not disclose the sum (Port Neches-Groves), 3 reported having refused to pay (Wood County, Penn-Harris-Madison, Claremont) and 7 have not revealed whether they have paid the ransom or not," the report noted.
The data was released 3 months after the firm published an initial tally of the number of educational institutions hit by ransomware from January to September. In the previous data, Armor revealed that a total of 54 school districts have fallen victim to ransomware attacks, which potentially affected over 500 K-112 schools.
With the result of the recent survey exhibiting a massive increase, the firm was able to conclude that school systems are now second to municipalities in terms of ransomware attacks. As of December, Armor’s findings revealed that cities and municipalities remain to be the top targets of ransomware attacks, with 82 total records in 2019 alone.
Following school divisions on the third spot are healthcare organizations, in which 44 total cases are recorded this year. Trailing behind them are service and cloud-based providers, with a total of 18 ransomware cases.
"With schools, municipalities, and healthcare, the common threat is a very low tolerance for any kind of downtime," said Chris Hinkley, head of Armor's Threat Resistance Unit (TRU) team. "They are all very tech-dependent, and also serve a lot of people, in most cases with taxpayer money. So there's a sense of urgency. ... Attackers have clued into that and it translates into a higher probability of payment."
In a separate report published by software company Emisoft, it was revealed that these educational organizations impacted by ransomware attacks included "86 universities, colleges and school districts, with operations at up to 1,224 individual schools potentially affected."
The F.B.I., on the other hand, maintains that all U.S. entities currently targeted by a ransomware attack must choose to not pay the ransom and must instead contact their local FBI field office.
