JEROME, Idaho (AP) \u2014 Nearly six weeks after being hit by a massive ransomware cyberattack, the Jerome School District is still working to recover.<\/p>\n\n\n\n
On Dec. 11, school district officials found out much of its data was encrypted. Each affected file included a message from the cybercriminal: If you want your data in a usable form again, you must pay us four bitcoin.<\/p>\n\n\n\n
The value of the virtual currency fluctuates. But at the time, it was equivalent to a total of $65,000.<\/p>\n\n\n\n
The Jerome School District didn\u2019t pay the ransom. School officials opted to rebuilt server systems using backed up files \u2014 ones that hadn\u2019t been affected by the cyberattack.<\/p>\n\n\n\n
\u201cI know we\u2019re very fortunate to have the (information technology) staff we have,\u201d business manager Brian Bridwell said Friday. \u201cWithout this group we have, I don\u2019t know what we could do. I don\u2019t know legally if a school district can pay a ransom.\u201d<\/p>\n\n\n\n
The best information the school district has now is the cyberattack encrypted data, but wasn\u2019t a theft and no confidential information was compromised, Superintendent Dale Layne said. \u201cTo our best of our knowledge, there wasn\u2019t any data stolen.\u201d<\/p>\n\n\n\n
School district officials weren\u2019t available to provide information to the Times-News about the incident shortly after it occurred.<\/p>\n\n\n\n
It was the Jerome School District\u2019s first time as the victim of a ransomware attack. The Idaho Attorney General\u2019s Office hasn\u2019t been notified of any other school districts affected, spokesman Scott Graf wrote in an email to the Times-News.<\/p>\n\n\n\n
But it doesn\u2019t mean school districts and businesses aren\u2019t being targeted, he said. Crimes may have been reported to local law enforcement agencies instead.<\/p>\n\n\n\n
The Jerome School District has now been able to restore its most of its computer systems, such as payroll and its student database.<\/p>\n\n\n\n
\u201cWe have the critical data restored for the most part,\u201d Layne said.<\/p>\n\n\n\n
About 95 percent of processes are functional, but there are still some connectivity issues, such as with a food service computer program and PowerSchool, a student management system.<\/p>\n\n\n\n
And the school district is still using a temporary website.<\/p>\n\n\n\n
Within a week after the cyberattack, the school district started working with Kroll, a worldwide cyber security company. The school district\u2019s insurance carrier is covering that cost, Layne said.<\/p>\n\n\n\n
So far, \u201cthey haven\u2019t been able to give specific answers about what information has been affected,\u201d Layne said, but it\u2019s very similar to other cases they\u2019ve seen across the nation. \u201cWe\u2019re trying to find out how (the cybercriminals) got in.\u201d<\/p>\n\n\n\n
Layne has done research and found out similar cyberattacks have happened all over the nation.<\/p>\n\n\n\n
\u201cIt sounds like they \u2014 whoever they are \u2014 do try to go after municipalities like schools and hospitals,\u201d he said, because they don\u2019t tend to have a large IT staff.<\/p>\n\n\n\n
The school district\u2019s three-person technology department \u2014 with help from Jerome High School IT workers and the district\u2019s vendors \u2014 spent hours restoring and cleaning up systems, rebuilding computers and buying new equipment. It also had to upgrade some of the server systems.<\/p>\n\n\n\n
There were multiple backups, Layne said, but some were affected by the cyberattack.<\/p>\n\n\n\n
\u201cKroll was very complimentary to our IT department,\u201d Layne said, adding the company was surprised the school district had backed up files it could get up-and-running so quickly. \u201cThere have been situations where whatever entity paid ransom to get data back.\u201d<\/p>\n\n\n\n
All of the Jerome School District\u2019s campuses were affected by the cyberattack. The district has about 4,000 students and several hundred employees.<\/p>\n\n\n\n
One of the biggest impacts: The phone system was down for a couple of days.<\/p>\n\n\n\n
\u201cThe phones were one of the primary systems we restored first,\u201d Bridwell said, followed by the district\u2019s financial software later on.<\/p>\n\n\n\n
When phones weren\u2019t working, parents couldn\u2019t call in their child\u2019s school absence. Instead, parents were asked to send an email to all of the school secretaries and they\u2019d receive a phone call back from a school employee via cell phone.<\/p>\n\n\n\n
In classrooms, some lesson plans were affected. All Windows-based computers in classrooms and computer labs weren\u2019t working. But mobile computing devices such as Chromebooks were still up-and-running.<\/p>\n\n\n\n
At school campuses, day-to-day life is somewhat back to normal. But it\u2019s still an ongoing effort at the school district office and the extra workload continues.<\/p>\n\n\n\n
As a result of the cyberattack, \u201cwe\u2019ve learned a few things,\u201d Layne said. \u201cWe\u2019re doing a better job with preparing.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"
The Jerome School District didn\u2019t pay a ransom, and instead opted to rebuilt server systems using backed up files \u2014 ones that hadn\u2019t been affected by the cyberattack.<\/p>\n","protected":false},"author":7,"featured_media":39686,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":10,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[10],"tags":[],"coauthors":[5526],"class_list":["post-14652","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber"],"acf":{"subheadline":"","legacy_arc_id":"CQ3DP3CRONAGHCZEX6HJDAWBHE","arc_canonical_url":"\/civilian\/2018\/01\/22\/idaho-school-works-to-recover-data-weeks-after-cyberattack\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n