Judson ISD Paid Ransom To Regain Access To IT Systems After Last Month’s Cyber Attack

This post has been updated to include confirmation a ransom was paid and a statement from Judson ISD.

A day after the Judson Independent School District announced it had regained access to its phones and emails, Texas Public Radio confirmed that Judson paid a ransom to restore at least some of the information technology platforms cut off during a ransomware attack on June 17.

District spokeswoman Nicole Taguinod said in an email Tuesday evening that a ransom was paid, but any other information, including the amount of the ransom, could not be released “because this remains an ongoing and active investigation.”

Four hours earlier, Taguinod had sent a statement to TPR and several other news outlets stating that “although it has been reported that a ransom payment was made, (the email and phone) restoration was achieved through the acceleration of key upgrades to reinforce the security of our systems in preparation for the 2021-22 School Year.”

Taguinod confirmed the ransom after TPR sought clarification on the meaning of the statement she sent to news outlets. The statement appeared to contradict information Superintendent Jeanette Ball provided to TPR the day before.

In an email sent to TPR Monday evening, Ball said she would need to consult the district’s attorney before confirming whether or not Judson paid a ransom to regain access to their communication channels.

“Legally I cannot share what is discussed in a closed session at a board meeting,” Ball wrote. “But as I stated before I will gladly discuss the payment issue with our attorney.”

One of the closed session agenda items on Judson’s special board meeting July 29 was a proposed settlement.

Ball added that the effects of the ransomware attack were far from over, and that it would likely be months before the full impact of the cyber attack was known.

“There is still a very long process to find out what if any information was taken and to determine whose and what information,” she said. “We are working with a third party to help us with that process, but they shared it could be months from now.”

Ball also said the district is using a new email system and lost access to emails sent before the attack.

“Once we have more details on what happened, how it happened and who and what was affected we will share,” she added.

Ball said the district hired outside experts to conduct a forensic investigation, but it will likely be months before the audit is complete.

Judson is San Antonio’s fourth largest school district, with about 24,000 students. School districts and other government entities in the United States have come under increasing threat from cybersecurity risks like ransomware attacks in recent years.

TPR was founded by and is supported by our community. If you value our commitment to the highest standards of responsible journalism and are able to do so, please consider making your gift of support today.

Source link

Sign up for our daily Maritme Cyber Analysis and Threat Intelligence news.