Colleges Continue to withstand Cyberattacks in 2021

Posted by Trevagh Stankard on Tue, Apr 13th, 2021

Located in British Columbia, Canada, Simon Fraser University informed its staff and student body of a cyberattack that breached one of its servers in February.  The data of some 200,000 people may have been compromised as a result of the cyberattack.   While the exposed data in question did not contain financial information or insurance credentials, it did include student and employee ID numbers as well as information concerning admissions and academic standings.  Fortunately, the schools internal IT division discovered the breach early enough to quickly isolate it, limiting the scope of the attack.  The university informed everyone who may had been at risk and advising them to monitor their personal accounts for unusual activity.

Unfortunately, this was not the first time the school had experienced this type of event.  A year earlier, the university experienced a largescale ransomware 2.0 attack.  Using this updated approach, ransomware organizers exfiltrate the company’s data before encrypting it.  Should the victimized organization manage to remediate the encryption attack on their own, the attackers have a backup extortion method in which they can threaten to sell or publicize the compromised data.  In this instance, the data of more than 250,000 people were compromised.  The information included not only ID numbers, but names, birthdates, contact information and web form data.  The university was able to recover from the encryption attack in one day, although the school refused to say whether they had paid the ransom.  Prior to that, the school had experienced cyberattacks on a much smaller scale.

Other Schools Completely Disrupted

SFU is far from the only school to be afflicted by cyberattacks.  On March 13, England’s South and City College of Birmingham posted a tweet informing everyone that it had experienced a major ransomware attack that had brought all of its IT operations to a complete halt.  The college had to resort to online learning in order to service it 13,000 students.  In-class learning was brought back the following week once all of the affected infrastructures was remediated.

Last year, the University of California, San Francisco was forced to pay a ransom of $1.14 million after its School of Medicine had to cease operations after being encrypted from a ransomware attack.  The school had experienced several unsuccessful attempts previously before being totally disrupted by this assault.  Other schools that experienced similar attacks in 2020 included Michigan State University and Columbia College, Chicago.  According to a report published by the cybersecurity company, BlueVoyant, ransomware attacks on colleges doubled between 2019 and 2020.  Another report went on to say that a number of ransomware groups are specifically targeting educational institutions because they are so lucrative. 

Why Colleges are Rich Targets for Hackers

Its not just ransomware attacks that colleges and universities have to contend with. According to a story in the Wall Street Journal, hackers have targeted more than 27 universities in the U.S., Canada and Southeast Asia.  Their objective is to steal research about maritime technology in order to use it for military use.  The fact that higher educational institutions host so much valuable and confidential research makes them a prime target for state sponsored hackers.  Another reason is large deposits of personal identifiable information of large student populations.  Cybercriminals can use the fresh credit histories of young people and utilize them for years.  Colleges and universities are also more prone to pay ransoms than other types of organizations as they want to limit teach disruption to a minimum. 

Besides being target rich environments for hackers, the open culture and lack of security controls make educational institutions extra vulnerable.  Investments in cybersecurity lag behind most other industries.  Enforcing minimum cybersecurity measures is extremely difficult for large scale BYOD environments.   To make matters worse, large universities use a decentralized organizational structure that allows each internal school or department to make their own IT decisions.  This prevents the university from establishing standard cybersecurity practices across the entire organization.  In addition, younger people are less experienced when it comes to social media attacks, making them more susceptible to hacking techniques.  Because student populations rotate every year, cybersecurity awareness training is extremely difficult. 

Conclusion

There is certainly no doubt that the upward trend of cyberattacks on colleges and universities will continue.  As a result, these institutions must make cybersecurity a major focus for the near future. 

Schools and colleges have an obligation to protect their students and staff from cyberattacks. TitanHQ can protect the education sector with multi-layer security. Arrange a call with a TitanHQ team member to learn how we can protect your school or college. Contact us today.