After Cyberattack, Nebraska Schools Could Face High Costs

Article

A cyberattack on a suburban Omaha, Nebraska, school district touched off an FBI investigation and is proving to be a significant, and perhaps costly, inconvenience.

Papillion-La Vista Community Schools officials said the district was forced to rebuild its servers after the May cyberattack, the Omaha World-Herald reported. Some desktop computers were replaced and hard drives were wiped clean. Operating systems on some teacher laptops will be replaced.

This summer, the district is requiring teachers and staff to bring in their 900 laptops for service. As of Wednesday, nearly 70% of those were fixed.

“It could have been worse than it was because we really got ahead of it,” spokeswoman Annette Eyman said.

The district has cyberattack insurance, which pays for expenses such as the forensic examination of computers.

But the district will likely have to pay some recovery costs, particularly personnel and new hardware, unless the cyberattacker can be found and held accountable, Eyman said.

Sixth-grade teacher Stacie Leonovicz typically would have been working in her classroom preparing for the school year. Instead, at 8:45 a.m. on Wednesday she was turning her laptop in for a fix at the district’s Technology Training Center.

“The biggest takeaway is we’ve seen how phenomenal our IT is,” she said, adding she relies heavily on technology in her classroom.

Student grades, financial information and other sensitive data were kept on a separate system, according to information technology director Lucas Bingham. He added the perpetrator of the attack has not been identified, noting the investigation by police and the FBI will take time.

The attack was introduced to the system via email and had the telltale signs of a ransom attempt — crashing the system and then demanding money to restore it, Bingham said.

But it never got that far, he said.

Bingham said employees detected the attack and took action to stop its spread. The district had backup systems that were quickly taken offline to preserve data.

Meanwhile, employees are getting refresher training in how to avoid inviting cyberattackers into the system, such as avoiding opening suspicious email.

“I think we all know that, but it’s good to get a reminder,” Leonovicz said.