The threat group MAZE claims to have carried out a ransomware attack on the twelfth-largest school system in the United States.
According to their website mazenews.top, the cyber-criminal gang has successfully targeted Fairfax County Public Schools in Virginia with crypto-ransomware.
As proof of the attack, the threat actors have uploaded a zip file of data they claim was exfiltrated from the school system. At time of publication, Maze had published just 2% of the data they claim to have swiped from Fairfax County Public Schools.
Commenting on the alleged attack, Emsisoft's Brett Callow told Infosecurity Magazine: "FCPS is the 206th public sector entity in the US to be impacted by ransomware so far in 2020 and the 53rd school district."
Callow said that operations at up to 11,190 individual schools and colleges have potentially been affected by ransomware attacks since January.
The costs associated with such incidents are high as victims pay for forensics specialists to determine how the attack happened, fund the implementation of new cybersecurity measures, and in some cases pay the ransom demanded by the attackers.
"In 2019, 966 governments, healthcare providers and educational establishments were impacted at a cost of $7.5bn," said Callow.
A recent report by Emsisoft predicted that the cost of ransomware attacks will increase as the practice of exfiltrating data from victims to use as leverage becomes more common.
"We anticipate that exfiltration+encryption attacks will become increasingly standard practice and, consequently, both the risks and the costs associated with ransomware incidents will continue to increase," wrote researchers.
"Additionally, as the big game hunters are successfully hunting ever bigger game, the overall economic impact of incidents will increase from its current level of $170bn."
If true, the ransomware attack on Fairfax County Public Schools is the second tech-based disaster to befall the school system in 2020. FCPS hit the headlines in April after repeated attempts to successfully roll out remote learning during the COVID-19-related school closures ended in failure.
Back in 2010, a nine-year-old boy managed to hack into the Blackboard Learning System used by FCPS to change teachers' and staff members' passwords, change or delete course content, and change course enrollment.