The Rising Threat of Ransomware to US Education and How to Beat It

A school employee receives an apparently unsuspicious email from a trusted source – in this case a co-worker. It’s been addressed to them, and its contents raise no red flags, appearing to be work related and legitimate. It also contains a link that the employee has no reason to suspect is not what it seems. The employee opens the link, unaware they have just triggered malware capable of logging keystrokes and extracting stored passwords. In doing so, they’ve become the victim of a spear phishing attack – a targeted cyberattack that is often the entry point for ransomware and is becoming increasingly common. 

This type of cyberattack isn’t the only way a school can fall victim to a ransomware attack, but it is notable. It demonstrates that despite having strong defenses and robust cyber policies and practices in place, institutions can and are being successfully attacked on a regular basis. According to Infosecurity Magazine, between 2018 and mid-2024, 491 ransomware incidents impacted over 8,000 schools and colleges across the United States, compromising roughly 6.7 million individual records. 

Schools and Colleges – the Ideal Targets for Cyber Criminals 

You might wonder why educational institutions are attacked by cyber criminals so frequently. The answer lies in the amount of sensitive data they hold, including student and staff identities, health records, and financial information. Combined with this is the fact that in most instances, they have limited financial resources, meaning they are likely to have less robust cybersecurity than businesses. They may also have limited IT staff resources and outdated infrastructure, all of which makes them very attractive targets. 

These attacks can be financially devastating for schools and colleges. According to education-focused publication K-12 Dive, the education sector lost 12.6 school days in 2023 and experienced an estimated cost of in $53 Billion in downtime over a 5 year period. 

In the corporate world, most enterprises are adopting the approach that it’s a matter of when, not if, they’ll experience a ransomware attack. The question is, if the business world – which generally has much larger IT budgets to work with – can’t always stop ransomware, where does that leave the education sector? The question then becomes, what can they do to address the ransomware problem? A key part of the answer to that is to have an effective data backup and disaster recovery (DR) plan in place. 

According to a U.S. Department of Education advisory on cybersecurity, only 53% of school districts who participated in a survey have an incident response plan in place for a cyberattack. While that percentage is increasing, it still means a vast number of schools and colleges would struggle to recover from a ransomware attack. 

When planning a DR strategy, it’s vital that immutable backups be factored in. They are the ultimate safeguard against data loss in the event of ransomware attack or other serious data related event. Having immutable backups in place provides the assurance that if the worst does happen, the institution’s servers, applications, and data can be brought online quickly, allowing continued operation with minimal disruption. 

A Managed Service Approach to DR that Matches the Needs of Schools

One of the biggest challenges that schools and colleges face in implementing an effective DR plan is managing data backups, which require ongoing attention and can be a drain on limited IT resources. To be truly reliable, they must be immutable, with a copy of the data held securely offsite. 

Many educational institutions are looking to managed service providers (MSPs) as an answer to their backup and DR challenges. This means that this vital aspect of their cyber resilience strategy is placed in the hands of experts, introducing new levels of protection and far more robust recovery capabilities. As-as-service offerings can also be more cost effective than self-managed solutions, as they require no capital expenditure. 

Another way in which managed data backups can be cost effective is through their scalability. A common issue experienced by educational institutions is data spikes that can result in significant variations in the volume of data that needs to be backed-up, impacting on IT budgets. When evaluating MSPs, it’s important to look for one that will work with you to investigate the cause of data spikes, advise on how they can be minimized, and help plan future backup requirements. A good MSP partner will offer consumption-based pricing and scalable services, allowing schools and colleges to grow or adjust coverage as needs evolve.

Boosting Cyber Resiliency in Education Through Managed Data Backups

Ransomware attacks on U.S. education institutions are a clear and growing threat, endangering student data, disrupting learning, and straining IT budgets. Managed service backup solutions offer a proactive, cost-effective defence that is automated and resilient. When considering MSP options, it’s important to select a partner that understands the specific needs of the education sector. It’s also important to work with a partner who can offer a backup platform that was built from the ground-up with immutability in mind. Assured Data Protection are experts in the provision of services to the schools and colleges. We work closely with data security specialists Rubrik to guarantee rapid restore of data and operations, helping to avert disruption through ransomware attacks. 

Reach out to a member of our team here for more information.