According to research published on Thursday, ransomware attacks cost U.S. colleges and universities more than $3.5 billion in downtime alone last year.
In 2021, 67 distinct ransomware attacks were recorded by Comparitech researchers, affecting 954 schools and colleges and around 1 million pupils. While all of those numbers represent double-digit percentage drops from 2020 levels, including a nearly 50% drop in the number of pupils affected, they may appear high.
Due to the fact that many school districts use out-of-date computer systems and lack the same financial and human resources for cybersecurity as many private organizations do, they have recently become a frequent target for cyberattacks, notably ransomware.
In addition, schools cannot afford to be closed down for an extended period of time, making it more likely that they will pay ransoms to have their systems opened. The rise of online learning and the epidemic has raised the stakes even higher.
For the study, researchers gathered data on all known ransomware assaults on educational institutions since 2018. However, the study makes note of the fact that many attacks continue to go unreported, particularly when ransoms are paid. Schools frequently don't disclose attacks unless there is a disruption of classes or a security breach involving student data.
Of the 67 attacks they examined, the researchers could only determine the ransomware payment amounts for six of them. As a result, rather than real ransoms paid, the $3.56 billion cost estimate is based on expected downtime and recovery expenses associated with the attacks.
Based on information obtained from 19 attacks, it can be concluded that an attack's downtime-the period of time during which schools were closed or most services were unavailable-averaged four days. Recovery times, during which schools were open but some equipment or services were not available, typically lasted for close to a month.
In 2021, a few ransomware assaults on educational institutions made headlines. In March, fraudsters successfully locked up the computer systems of one of the biggest school districts in the U.S., Broward County Schools, and demanded a staggering $40 million in ransom. The data was uploaded on the internet after the district rejected to pay.
The researchers claim that so far this year, ransomware attacks against schools have been less frequent in 2022. The number of documented attacks is down from levels one year ago, and outage and recovery times have also decreased, according to researchers.
The lower downtime rates indicate that schools are better prepared for these attacks and are better able to recover their systems from backups or limit the consequences of the attacks, according to the researchers, who speculated that hackers may be getting more targeted in their approach.
