Hacker releases PII on Las Vegas-area students after officials don’t pay ransom

https://www.wsj.com/articles/hacker-releases-information-on-las-vegas-area-students-after-officials-dont-pay-ransom-11601297930

by sizzle • 6 years ago

29 55 6 years ago

wsj.com

EricE• 6 years ago

Yowza - I have several friends who were affected by this :(

As a reminder, if you have kids - freeze their credit!

https://www.nerdwallet.com/article/finance/child-identity-th...

jedberg• 6 years ago

At this point, I feel like frozen credit should be the default.

Nextgrid4• 6 years ago

There's an entire industry out there which benefits from the fact that credit is easy to access, even if it exposes people to risks of fraud & identity theft.

If banks' interests were aligned with their users (or legislation forced them to) the whole credit history system would be replaced by something more secure & less prone to fraud.

sofixa• 6 years ago

At this point, as a non-American, i feel like you people accepting to have a credit rating system is ludicrous. It's fundamentally broken, has been exposed multiple times, requires gaming to work in yiur favour ("open a credit card as soon as you can, pay little things with it and pay it off immediately to beef up a good score") and brings nothing to you, the people.

For comparison, in France, the national bank keeps a record of all loans anyone has taken. When you apply for a new loan, the bank will check with the national one your history, and decide based on that to lend or not, and inform the national bank of their decision. I suppose Americans can be afraid that "the government" will know their loan history in such a system, but it's not like they can't currently ask and het that information, and they're still more trustworthy than commercial companies that don't care about you ( their clients being banks and companies) or your data beyond their sales.

But it's not like anyone on the US would dare to destroy a profitable industry.

neonate• 6 years ago

https://archive.is/9CD63

edtechstrats2• 6 years ago

I track US public school cybersecurity incidents and this represents a change in tack for ransomware attackers vis-a-vis schools. Clark County (Las Vegas) is only 1 of 3 school districts since the start of the school year compromised with ransomware alongside the exfilitration of student/employee data. The others include Fairfax County (VA) and Haywood County (NC). Overall, I count 35 instances of ransomware (K-12 districts) for all of 2020; 15 of those publicly disclosed since August 1, 2020.

https://k12cybersecure.com/map

PS The latest incident, with commentary from the district superintendent: "Got to work this morning, powered up my computer and the first message I got was you’ve been encrypted. Basically, you know, the same old thing…you’ll have to pay us in bitcoin, we’re holding your data ransom, you need to contact this email address."

https://www.kalb.com/2020/10/02/cyber-incident-affects-avoye...

mehrdadn2• 6 years ago

How long will it be until we realize cryptocurrencies are causing problems?

arcticbull8• 6 years ago

But how will we pay ransomware authors (while expending 620kWh and creating 107g of electronics waste per transaction [1]) if we don't have cryptocurrencies?!

Oh no wait I see the problems.

[1] https://digiconomist.net/bitcoin-energy-consumption

deburo• 6 years ago

Do the major crypto runners work towards being more energy efficient, or do they not care at all? Maybe they already sponsor the development of new nuclear power plants.

vmception7• 6 years ago

That site makes only a back of the hand assumption about how much energy use is a renewable or clean source.

My work with large miners - who all rely on clean or reducing pollution by using unused energy - and the economics of all miners would say that 75% of all mining is renewable energy.

You would therefore have to divide all their problem metrics by 50-60%.

Regarding "e-waste as much as Luxembough", is that really a lot? I don't actually know what to compare that to, all I see is "gasp a country!" and no quantitive metric compared to say any other industry or even other jurisdiction's use. With that in mind, I also am not sure it is accurate. Bitcoin e-waste doesn't really result in more machines, it results in the same amount of machines being replaced and doing more. This is because the economics has already pushed people to renewable energy sources, and the people that can already have. People that are just catching on are using people's "wasted" machines and mining with those.

Ah the source you ask? All the private details about my clients. Hm, yeah not going to happen, there might be a few press releases, and there might be a few court documents that have nothing to do with mining but normal business disagreements in companies that do mine.

The balanced answer is that this is something to remain vigilant about. Nations mining at a loss and printing currency to do so will absolutely not care about the power cost or source, and this is where we are headed. The private sector is not capable of doing this as uneconomically as that site suggests, pay attention as that site's assumptions are intertwined with facts. Just notice where they don't have any facts and be willing to balance that with other accounts like mine.

phailhaus• 6 years ago

There's no way to "shut down" Bitcoin. Cryptocurrencies are a new technology that we have to learn to deal with.

reaperducer• 6 years ago

There's no way to "shut down" Bitcoin

Sure there is. Just make it not possible to convert Bitcoin into real things. If it can't be turned into money or candy or online gaming tokens or electric eels and remains virtual, then what's the point?

the8472• 6 years ago

The invisible hand perspective is that cryptocurrencies help putting a price tag on insecure systems.

Nextgrid4• 6 years ago

Before cryptocurrencies were widespread ransomware used vouchers such as PaySafeCard to get paid. Tech support scams use gift cards to get paid.

I'm not convinced that banning cryptocurrencies will 1) significantly curb ransomware activity nor 2) that it's worth banning a tool with legitimate use that's valuable in certain countries with unstable economic situations (there are valid, non-nefarious reasons for why you'd need to move money without your government's approval).

mehrdadn2• 6 years ago

Before cryptocurrencies were widespread ransomware used vouchers such as PaySafeCard to get paid.

Really? You're suggesting this happened on the same scale? So how many hospitals got hacked like this with PaySafeCard? How frequently did these occur? Nothing's changed since cryptocurrencies came along?

Tech support scams use gift cards to get paid.

That's why nobody even mentioned tech support scams.

tromp• 6 years ago

Not all all of them support non-interactive transactions.

Mimblewimble based coins require an interaction between payment sending wallet and payment receiving wallet, making them unsuitable for ransom payments.

Aerroon• 6 years ago

Here's a different suggestion: how about schools get enough civet security that her don't leak their students' information? Whether hackers can demand a ransom in crypto currency or not doesn't change that the school district made their students' personal information vulnerable.

If the school feels that they cannot handle cyber security at such a level then use a typewriter for students' personal information. Once this information gets out there it can't be unreleased.

Edit: I do concede that crypto currencies probably increased the amount of ransom attacks on systems. I also think that security in systems that don't contain any PII probably isn't as important and these attacks do affect them too.

bluGill2• 6 years ago

Still the right thing to not pay up. If nobody pays they will give up eventually.

Make sure that you have good backups. So you can laugh at their demands.

Red_Leaves_Flyy• 6 years ago

Backups are an essential part of the solution. However, for this case, one also needs the infrastructure, on isolated standby, to automatically revert every impacted device asap to stop the bleeding.

Didn't a company with backups recently pay because they realized restoring would take months?

acchow• 6 years ago

"nobody pays"

This will likely require criminal penalties to enforce.

Nextgrid4• 6 years ago

Which will never happen when 1) some law enforcement agencies themselves got affected and 2) as long as the ransom is less than the cost of recovery there's always the possibility for the payment to be done "underground" and off the books.

PeterisP• 6 years ago

Even if you have good backups, you're still vulnerable to blackmail about public disclosure of data you're required to safeguard, just as in this case.

bluGill2• 6 years ago

Paying up doesn't save anything, they still have the data and can release it anyway.

dmurray• 6 years ago

Presumably the school district doesn't really care about its students' PII being released. I mean, they might feel a bit bad, and all else being equal they'd prefer not to have it released, but no one's going to lose their jobs or their funding just for that.

So the enforcement mechanism here has to be through the courts: some student or students will sue the district for negligence. Paying out millions of dollars in legal settlements is something the district will care about, and might cost someone their job, so it's a good stick for the hackers to use if the district would lose such a lawsuit.

What's the case law like here? Are they likely to lose?

nerdponx• 6 years ago

...millions of dollars of taxpayer money.

nickff• 6 years ago

"Paying out millions of dollars in legal settlements is something the district will care about, and might cost someone their job"

I'd bet this is something the voters will care about, but it's likely to be attributed to some 'innocent mistake', 'communication error', or 'server misconfiguration'. The school district won't lose any revenue, and I doubt anyone will get fired. Maybe a contractor will get scapegoated.

People on HN complain about how reckless private companies are with their data, but bureaucracies are even less accountable.

edtechstrats2• 6 years ago

Parents/students do not have a private right of action under applicable federal law (FERPA). The US Dept of Education could theoretically hold the school district to account, but that would be extraordinary (speaking of the current context, but also historically).

kiba• 6 years ago

It's against the law to pay the ransom. So damned if they do, and damned if they don't.

I supposed it may light the districts' ass to get good security, but if you don't know what good security looks like, how are you supposed to know?

HenryBemis• 6 years ago

USA has a good number of security frameworks. Collaborating with a more advanced education institute (for guidance) and setting a programme/project would be possible if they wanted (or now to prevent the shitshow from happening again).

Any uni that has undergone similar project will have the project charter, resources, skills, timelines, lessons learned (the whole project folder).

Where there is a will there is a way. And I believe thay many organisations DO know that they operate on low/bad security, they just prefer to roll the dice and use the budget for something else..

Aaronstotle• 6 years ago

Do students and families have any legal action to take? The school failed to protect personal information under their watch.

If I was a parent, I would be livid.

Hacker releases PII on Las Vegas-area students after officials don’t pay ransom

Related Stories