Ransomware ravaged schools and cities in May

Ransomware caused significant disruptions across the public sector in May, forcing school closures and hindering one city's emergency services.

The widespread threat continued last month following several vendors' reports of record high ransomware activity levels for 2023. Despite recent law enforcement efforts to disrupt the LockBit ransomware gang, the prolific group claimed responsibility for many of the attacks in May that affected schools, cities and healthcare organizations.

Ransomware gangs heavily targeted the education sector last month. Several U.S. cities, hospitals and a public library also reported attacks that caused significant disruptions and led to data breaches involving highly sensitive information.

Two such attacks occurred during Memorial Day weekend. Ransomware gangs commonly target victim organizations during holidays when businesses are understaffed.

The Seattle Public Library disclosed it suffered a ransomware attack on May 25 that affected computer access, its online catalog, e-book services and Wi-Fi network. The library, which has 27 locations across the state, forced systems offline because of the attack and contacted law enforcement.

In a series of updates beginning on May 28, the library said the attack occurred just one day before planned server maintenance that required a system shutdown. As of June 3, all locations are open but online services, including account access and Wi-Fi, remain down.

"At this time, we do not have an estimated time for restoring impacted services," the Seattle Public Library wrote in an update.

Center Line Public Schools in Michigan also experienced a ransomware attack on May 25. C & G Newspapers reported that Center Line was forced to cancel classes the following Tuesday because of the attack that affected the school's Wi-Fi, internet, security cameras and educational software. Center Line told the news outlet that students were still able to use Chromebooks, and classes resumed on May 28. An investigation to determine whether a data breach occurred remains ongoing.

On May 15, another Michigan-based school also suffered a ransomware attack. Fox 17 reported that students and staff at Rockford Public Schools discovered ransom notes in printers on the morning of the attack. Attackers threatened to leak stolen data if the school did not pay the undisclosed ransom demand. Fox 17 said the attackers claimed to "not be a politically motivated group" and promised to provide a decryptor once the ransom was paid. It also warned the school not to engage law enforcement.

Superintendent Steve Matthews told the news outlet that the attack shut down access to computers, internet and phones across all district buildings, which includes 15 schools with more than 7,000 students. Classes continued, but students and staff were forced to revert to pen and paper as systems remained down.

The City of Richland in Washington was also hit by ransomware on May 15. Richland officials disclosed the attack in a Facebook post on May 17. The city warned citizens that the attack potentially exposed sensitive personal information of residents, including names, addresses and contact details. Additionally, the attack disrupted emergency services.

"We want to inform you that we have confirmed that there has been a data breach incident affecting our servers and systems at Benton County Emergency Services (BCES) and the City of Richland (City)," City of Richland wrote on Facebook.

Richland provided more updates to its website. As of May 31, the city said systems were restored and Richland citizens should have access to most services and be able to make utility payments. However, the city was still in the process of upgrading its building and permitting software, which it anticipated would be operational by June 3. An investigation into the attack remained ongoing.