Cyber event at Northwest Indiana school highlights growing number of cyberattacks on schools

CROWN POINT — As cyberattacks on schools increase across the state and nationwide, WRTV Investigates has learned another Indiana school district has suffered a cybersecurity incident.

The Crown Point Community School Corporation announced November 30 that they discovered a “cyber event” that caused significant disruption to their IT network.

The investigation is expected to take weeks, and it’s not yet clear if any sensitive or personal information is at risk because of this cybersecurity incident.

The district closed school for students on Monday as a result.

“Although we have not yet determined if any sensitive or personal information is at risk as a result of this event, we are providing you with information about proactive measures you can take to protect your or your child’s information should you feel it is appropriate to do so,” said Dr. Todd Terrill, Superintendent of Schools, in a statement.

The district is asking employees and families to consider taking the following steps:

• Monitoring your financial statements carefully. 
• Monitoring your credit reports for suspicious or unauthorized activity. 
• Placing a fraud alert on your credit file. 
• Placing a security freeze on your credit file. 
• Reporting incidents of suspected or actual identity theft or fraud 

It’s a problem WRTV Investigation has been tracking.

Indiana school districts have reported 46 cyberattacks and attempts attacks since July 2021, according to data obtained by WRTV Investigates.

PREVIOUS |Growing number of Indiana schools hit with cyberattacks

These incidents can cost schools precious time and put your child’s personal information at risk.

Even when no information is compromised, cybersecurity threats can be quite costly to Indiana school districts.

WRTV Investigates filed records requests and found Indiana schools have paid tens of thousands of dollars to help recover from cyberattacks and to improve their IT systems after the fact.

• Baugo Schools spent $10,000 to upgrade their firewall following a cyberattack
• Logansport Schools pays a company $30,000/year to help monitor its systems 24/7
• Mooresville is spending $80,000 a year on cyber protection.  A district spokesperson told WRTV, “We added Sentinel One to our cyber protection initiatives this summer at a contracted cost of approximately $80,000/year.”
• Duneland Schools has paid more than $281,703 for cybersecurity services and consulting over the past year, records show

The U.S. Government Accountability Office issued a report today that said some schools across the country have reported monetary losses ranging from $50,000 to $1 million due to expenses caused by a cyber incident.

The U.S. Government Accountability Office’s report recommended that the U.S. Department of Education and the Department of Homeland Security improve its coordination, enhance schools’ awareness of the federal services available to them, and measure the effectiveness of cybersecurity products and services used by schools.

The office found cybercriminals are using several techniques including:

• Phishing, which is an attempt to acquire data or other resources through a fraudulent solicitation in email or on a website.
• Ransomware, which is a type of malicious software that attempts to block access to computer or data systems. During a ransomware attack, the perpetrator demands a fee to be paid in exchange for restoring access.
• Distributed denial-of-service attacks, which prevent or impair authorized use of networks, systems or applications by multiple machines operating together to overwhelm a target.
• Video conferencing disruptions, meaning attacks that disrupted teleconferences and online classrooms, often with pornographic or hate images and threatening language.

PREVIOUS | How cybercriminals sell your information on the dark web

In Indiana, a new law took effect in July 2021 that requires schools and local government agencies to report cybersecurity incidents to the state’s Office of Information Technology within 48 hours.

Indiana is one of only 10 states with a law requiring local government agencies to report cybersecurity incidents to the state.

WRTV Investigates uncovered in the last year, Indiana school districts reported 46 cyberattacks and attempts attacks.

“There’s a lot of cyberattacks out there,” said Graig Lubsen, Director of Communications and External Affairs for the Indiana Office of Technology. “It's happening everywhere, these attacks.”

The Indiana Office of Information Technology is traveling the state to educate schools and government agencies about the new cybersecurity reporting law.