Officials tell schools not to pay ransomware demands. Parents disagree, survey finds

August 15, 2021

A majority of parents would support their children's school districts paying off hackers in the event of a cyberattack, research shows. The survey found that 72% said they'd support paying hackers' demands if it meant keeping their kids' personal data, academic histories and medical records from being leaked. And 67% of parents said they were either somewhat or very concerned that their child's schools will be hit by a cyber attack.

Brian Bartholomew, a principal researcher at Kaspersky was "left scratching my head" by some parents' concerns over the threat of ransomware. But he says he understands their fears as schools aim to resume more normal operations after a year-and-a-half of pandemic-induced restrictions. "Parents want to have their children have some normalcy with their education, and the last thing they want is to close down," he said.

Schools across the country have lost days of virtual and in-person learning over the past two years. "Actors are not after extravagant victims. The majority of [school districts] are under-resourced," Bartholomew said. Fairfax County, Virginia, Public Schools has seen student and staff information stolen and published after refusing to pay.

Despite guidance from the FBI and other agencies, schools often pay out anyway to avoid a leak of data that might have legal consequences. The Judson Independent School District in Bexar County, Texas, acknowledged paying unnamed ransomware actors $547,000 to regain access to locked-up systems. Officials there said they had "no other choice" after the leak of students' and teachers' personal information.

"Do we tell the clients and risk the wrath of the clients?" Bartholomew asks. Schools "are the custodians of our children" tasked with handling their data responsibly, he says. "If they fail, whether it's their fault or not, it is their responsibility to let their customers know," he adds.

Just 34% of parents whose schools experienced an attack were informed directly, while 57% heard about incidents from secondary sources. 80% say schools give them information about cyber preparedness, but schools are less forthcoming when it comes to alerting communities about a ransomware event. The Center for Internet Security expects an 86% jump in the number of cyber incidents affecting K-12 schools.

To read about this in greater detail please visit: