A Mississippi school district has voted to pay $300,000 to recover files that were encrypted during a suspected ransomware attack.
A federal investigation was launched after threat actors accessed Yazoo County School District’s information technology system without authorization.
Superintendent Dr. Ken Barron told WLBT news that the school became aware of the cyber-attack on Monday, October 12. Barron did not state how the attackers had gained access to the system or what information had been compromised as a result of the incident.
The superintendent said that individuals would be notified about the incident if required by law. He stated that he had been advised against revealing any further details of the attack in case it jeopardized the investigation being carried out by federal law enforcement.
Following the attack, the school took its IT systems offline and engaged a cybersecurity firm to help recover data encrypted by threat actors. Classes at the school are operating as normally as possible under existing COVID-19 restrictions.
The school board voted to pay a company $300,000 to recover the data that was encrypted by malware.
"Last week, the Yazoo County School District detected a potential cyber event impacting certain devices on our network. We took our IT systems offline to investigate and address. National cyber-security firms were engaged to assist. We also reported this to federal law enforcement," wrote Barron in a statement issued by the school
"In an abundance of caution, we are deploying advanced cyber-security tools throughout our environment to ensure devices can be used without issues and to allow us to resume normal IT operations as quickly as possible. We are also taking measures to unlock the encrypted files."
Barron said that staff payroll, cafeteria transactions, and the school's phone, fire alarm, and burglary systems were not impacted by the attack.
He added: "This is an ongoing investigation and as such, we have been advised by cyber-experts not to comment further at this time. We will notify individuals if and when needed in compliance with federal and state law."
Lincoln County Schools, another Mississippi school district, fell victim to a ransomware attack in November 2019.