IT security expert offers insight after cyberattack impacts Newton Schools

NEWTON, Kan. (KWCH) - A situation the Newton school district described as “a network security incident” prompted school closures for Wednesday and Thursday as efforts continue to unravel the potentially data-compromising mess.

The situation in Newton is the latest example of schools being a popular target for cyberattacks. 12 News on Wednesday spoke with an IT expert to look into how these attacks happen and why cybercriminals target schools.

Newton Schools hasn’t specified the exact nature of the network security incident or if any personal or confidential information is at risk. In an update provided Wednesday afternoon, the district said it expects classes to resume Friday, March 31. There’s an ongoing investigation into what happened and what’s affected.

Soteria Technology Solutions CEO Bill Ramsey said public organizations often find themselves targeted by cyberattacks.

“Government and public kinds of entities usually are more at risk because they are so public and because they’re so much larger and there’s a better chance of infiltration,” Ramsey said.

The US Government Accountability Office (GAO) reported cyberattacks on school districts jumped significantly from 2018 to 2020, going from impacting about 38,000 students to nearly 1.2 million. That total dropped to about 650,000 in 2021.

Common attacks include phishing, which seeks to take data or information, distributed denial of service, which can prevent access to networks, and at times the most prevalent, ransomware, which locks and holds a system for ransom.

“[Cybercriminals] can take over almost instantly. By the time it gets installed, it can start replicating itself throughout the network,” Ramsey explained.

He said attacks are becoming more popular “because it’s so easy to make money and it’s way easier than you think.”

The complexity of the attack and an organization’s preparation can determine how quickly a network can be restored, whether that’s a few hours or a month or longer, Ramsey said.

“If you don’t have those specific kinds of backups, if you don’t have those safeguards or disaster recovery in place, it can be very traumatic and take a tremendous amount of time to bring back,” he explained.

A reason why these attacks often get through is the people on the network.

“Humans are the biggest weak link on any network. We just are,” Ramsey said.

The Government Accountability Office found a loss of learning because of cyberattacks on schools ranging from three days to three weeks and that it can take up to nine months to fully recover. With school canceled Thursday in Newton, the district said students will be able to pick up lunches at the high school, and the Newton Rec Commission clubhouse will provide latchkey all day.

Copyright 2023 KWCH. All rights reserved. To report a correction or typo, please email news@kwch.com