Cyberattack Costs Rural School District $92,000, Dozens More Hit Statewide

School lockers. (Pixabay License).

Hackers appear to have stolen about $92,000 from the rural Adams-Friendship Area School District, according to a letter sent to parents.

“Based on the information available, we believe the district may have been the victim of a cybercrime,” the letter states. The district headquarters are roughly a half an hour south of Wisconsin Rapids.

Cyberattacks are a growing concern for schools in Wisconsin and across the country, according to state and federal education officials.

The Adams-Friendship incident is one of more than 40 cyberattacks hitting Wisconsin K-12 schools so far this year, according to the state’s Department of Public Instruction. Recently, DPI put out a warning to districts about the importance of preparing for attacks.

Dorothea Salo, professor with the University of Wisconsin-Madison’s College of Computing and Artificial Intelligence, said scammers will send out hundreds of scam messages to organizations — hoping one will take the bait.

“They have no shame,” Salo said.

Hospitals, libraries and other public institutions are also increasingly becoming targets for scammers, she said. That’s because they tend to be “soft targets.”

“They don’t have a whole lot of cybersecurity staff,” Salo said. “Their IT people are often incredibly overloaded, and that just makes it easier to slip something past.”

And across the country, the number of cybercrimes targeting K-12 schools is increasing, according to the U.S. Department of Education.

“School districts across the country are experiencing an average of five cyber incidents per week,” according to the department.

In Wisconsin, DPI said local districts are facing a growing number of cybersecurity threats.

“Cybercriminals are increasingly using artificial intelligence to identify vulnerabilities and create convincing scams targeting staff, students and families,” the department said.

Bank flagged suspicious transaction

The district’s superintendent, Nicki Ells, wrote the letter describing the cyber incident. She noted in the document that law enforcement is actively involved.

“The district takes its responsibility as steward of the community’s tax money extremely seriously,” the letter states.

This letter was sent to WPR, and parents in the Adams-Friendship District, explaining the incident and investigation.

In an email to WPR, Ells said the investigation into the incident is ongoing and the district will share more details in the future. At this time, she said she could not comment on how the loss of money may impact the district.

Few details about the actual theft have been released, but Ellis’s letter states money trouble was first noticed back in August.

The district’s bank notified school officials of an “unusual” payment request from a “third party,” according to the letter. The payment was processed by the district’s business manager.

After that, the district contacted law enforcement, an attorney and its insurance provider to start an investigation into the missing cash, the letter states.

“Additionally, the district is working with its insurance provider to recover all of the funds,” the letter states. “And a claim is currently being processed.”

On Oct. 16, the district placed the business manager on administrative leave, the letter states.

“This step is not a determination of wrongdoing,” Ells wrote in the letter. “Rather, the leave ensures that the district can further investigate this situation as well as review the district’s business operations as a whole.”

Schools frequent target of scams, Dept. of Education says

Last year, the Department of Education compiled a cybersecurity report looking over data from 5,000 K-12 institutions over 18 months. It identified over 9,300 confirmed cyber incidents, and 82 percent of schools said they had experienced impacts from those cyber threats.

Salo said with the rise of AI, scamming has become even more common and difficult to detect. Falsifying voices, impersonating email addresses and other common techniques are only aided by AI.

And the people and organizations targeted are often in high-stress or extremely busy jobs, meaning double-checking a strange email may not be a top priority, according to Salo.

“That could happen to anyone, but it does make me feel for organizations like schools that are just chronically understaffed,” she said.

The DOE report shows common cyber threats included ransomware attacks, where hackers held software hostage during exam periods. Other common problems were data breaches and malicious software being introduced to the district and stealing information.

One of the top threats were phishing attacks, where hackers tricked staff into revealing credentials, the report states.

“Cybercriminals trade on the shame that you feel when they get you the first time,” Salo said.

The only way to stop a second incident is to make sure staff feels safe reporting these incidents, she said.

“The boring but true answer, particularly for fake invoices and stuff, is really good accounting controls,” she said.

A rural school district lost nearly $100K in ‘cybercrime,’ 1 of dozens of attacks on Wisconsin schools this year was originally published by Wisconsin Public Radio.