And that’s yet another UK education body under attack from ransomware: Servers, email, phones yanked offline

The Harris Federation, a not-for-profit charity responsible for running 50 primary and secondary academies in London and Essex, has become the latest UK education body to fall victim to ransomware.

The institution itself claimed it was “at least” the fourth multi-academy trust targeted just this month alone.

In a message to pupils and parents, the group, which is led and run by teachers, admitted that criminals had meddled with its servers.

The group revealed the attack took place on 23 March, the very same day a warning was issued by the National Cyber Security Centre (NCSC) that the UK’s education sector was being targeted by crooks.

The impact of the attack was severe. Not only have servers been pulled offline, but both the telephone and email systems have been yanked, and each academy switchboard diverted to a mobile telephone. “Cyber-criminals,” the academy explained, “have accessed our IT systems and encrypted, or hidden, their contents.”

The break-in was discovered on 27 March, but as of yesterday the academy was still working to understand what had befallen it and what might or might not have happened. The National Crime Agency and NCSC are also involved, and the group is liaising with the Information Commissioner’s Office.

And all those devices handed out to pupils? Now disabled “as a precaution.”

The trust is just the latest educational establishment to discover its defences were not all they could be. The University of Northampton admitted on 17 March that its own network had been hit by criminal activities, leaving phones and networks down and students struggling to submit assignments.

How the ransomware made its way into the Harris Federation’s network is unclear, although following the trend, the group described the attack as “highly sophisticated.” The NCSC has highlighted phishing emails, shoddily configured remote access, and VPN vulnerabilities as common attack vectors and recommends a “defence in depth” approach to both disrupt the attack vectors and enable recovery.

In a nutshell – patch, secure, educate and, for goodness sake, make sure those offline backups are both taken and actually work.

The Register has contacted the Harris Federation for more details and will update should a response be forthcoming. ®

READ MORE HERE