News broke this morning that Howard University, located in Northwest Washington, D.C., cancelled classes due to a ransomware cyber attack that disrupted several of the university’s systems. The attack was first detected on the Friday before Labor Day, leaving more than 11,000 undergraduate students without access to Wi-Fi on campus over the holiday weekend.
According to Chuck Everette, Director of Cybersecurity Advocacy at Deep Instinct, these attacks are part of a broader trend of increased cybercriminal activity over U.S. holidays, which should serve as a warning for upcoming breaks such as Thanksgiving and Christmas.
"It’s no surprise that cyber-criminals will use anything to their advantage, including attacking with devastating results over holiday downtime. As we come out of the US Labor Day holiday weekend, the reports of ransomware attacks are starting to come in. The attack on Howard University is just the latest attack on education this year. This year alone, there have been 29 reported major attacks against the educational sector, a sharp increase over 2020 when 32 were reported for the whole year - with 35 percent of the victims that had reported encrypted data from a ransomware attack giving into the demands and paying the ransom. This makes for a very lucrative target for these cyber-criminal gangs.
Educational targets can be lucrative for cyber-criminals due to the double extortion tactics they are now employing; not only are they encrypting and disabling the environments of the victim and then demanding a ransom to restore it. They are now extracting data from the victims' environment and then demand additional ransom to not publicly release the information. As we know, the educational sector collects a tremendous amount of data on its students and faculty. This information contains not only personal identifiable information (PII) but also financial and medical records.
One key piece of information we need to keep in mind is that there has been a sharp uptick in criminal activity and ransomware attacks over US holiday breaks. With that in mind, we need to be mindful of the upcoming Thanksgiving and Christmas holidays. Based on past experiences, we can safely say we are going to see a lot more attacks during this time, and IT and security professionals will need to be even more vigilant over holiday breaks than in the past. We cannot let our guard down. Organizations need to prepare and perform a thorough review of their security stacks and defenses. I also encourage IT and security professionals to step back and adopt a prevention-first strategy. Prevent these attacks from penetrating your environments; we cannot allow these cyber-criminals free access to critical infrastructure. Deny them access to your environments before they deny you access to your own data and systems.” ###