If a group of criminals targeted a Walmart, they would get in as quickly as possible, grab what they want before tipping off security, then go full scorched earth on their way out to cover their trail.

Superintendent Brent Johnson said that’s what happened on Saturday, Oct. 17, when a sophisticated, international criminal group waged a ransomware attack on the Jerome School District.

“This is a terrorist crime that happened to us,” Johnson told EdNews on Thursday. “It’s terrible, and it’s much the same as a physical crime.”

The group, which Johnson declined to name to avoid giving them publicity, is known by federal law enforcement. Artificial intelligence has helped cyberattackers become more efficient, he said, and it’s a struggle for school districts to keep pace.

“You have a constant arms race,” he said. “If the professional hackers can’t beat the newest and greatest security stuff, they go out of business. That sounds really weird to say, but that’s the eventuality of it.”

Twelve days after the attack, Johnson could share some details of the ordeal and aftermath with EdNews but said a forensic investigation is ongoing. Legal counsel also advised him not to reveal safeguards the district had in place before the attack.

“That was something I’ve been advised not to share because it’s like telling the enemy where you’re strong or weak,” he said.

Isolate and contain

The attack began in the pre-dawn hours of Oct. 17.

The district’s security systems alerted some staff. Johnson said the district received ransomware notices. Technology staff worked through the weekend to minimize damage.

“You want to shut the internet down so things stop spreading and you can isolate, contain and then move towards solutions,” Johnson said.

So many systems in schools — and in homes these days — are connected to the internet. Johnson said district cameras, door locks, heating and cooling systems, phone systems, and communication infrastructure were shut down. The district canceled school for two days.

“Unfortunately, it did bring down a lot of the systems that prevented us from going to school that Monday and Tuesday,” he said. “It was really safety related.”

After becoming aware of the attack, Johnson said the district immediately notified its school resource officers to get local law enforcement involved. The district also alerted the federal Cybersecurity and Infrastructure Security Agency (CISA), which provided cybersecurity and mitigation experts. A national cybersecurity nonprofit also helped out.

In a ransomware situation, he explained, the criminals want to get data that they can ransom for money. The forensic investigation into what data was stolen is ongoing. Student devices were completely unaffected, but it appears the hackers possibly accessed data on some of the district’s 500 staff devices. Those staff devices had to be evaluated before they could be brought back online.

Following guidance from federal law enforcement and cybersecurity experts, the Jerome School District has not paid the ransom.

“I will not share the specific amount requested for the ransom at this juncture of the investigation,” Johnson wrote in an email to EdNews on Friday in response to follow-up questions. “I can say that it was an amount that was not feasible for a school district of our size, at which point communications were broken off. While we are insured for such events, the requested ransom far exceeded our coverage and would have required district funds.”

Back to ‘old-school school’

When school resumed last Wednesday, classrooms in Jerome School District were back to basics for a few days.

Teachers had to adjust on the fly to prepare lessons without technology.

“We had a couple of days of old-school school, which some people really liked,” Johnson said.

The last staff devices have now been reissued and classes are more-or-less back to normal. The district is now in the investigation stage and working to pinpoint how the breach occurred.

‘This is the reality’

In the days after the attack, Johnson said local businesses have reached out to the district to say they have also been victims of cyberattacks. Other school districts have asked him how Jerome handled this attack.

“There’s been a lot of positivity, and it’s also really discouraging that this is the reality of our world right now too,” he said.

In his personal life, Johnson said his grandmother received a phone call a while back from a scammer pretending to be him, saying he was in a car crash. Luckily, she called him and found out it was a scam.

Phishing attempts — when scammers send a fake email or text to try to get information or access — are also very common these days.

“It’s crazy, but people pretend to be me and email the employees,” Johnson said. “We have phishing protections and we have training to try to help folks out, but we get a lot of email and we have a lot of employees, so it’s difficult.”

In the wake of the latest cyberattack, Johnson said the district continues to look at vulnerabilities and how to structure defenses to make systems as secure as possible.

“I don’t know that there’s any perfect defense or solution, but we want to be as close to perfect as we can, and continue to evolve every year that we’re ahead of the curve there,” he said.