Croton-Harmon School District

Summary

Two Westchester school districts experienced a cybersecurity attack targeting their school-issued desktops and laptops, disrupting remote learning operations. The incident was confirmed as a ransomware attack that compromised system access, requiring multiple days to resolve. The breach forced both districts to implement recovery measures while addressing the operational impact on students and staff.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On October 19, 2020, the Croton-Harmon School District in Westchester County, New York, experienced a cybersecurity incident alongside the neighboring Yorktown Central School District. The attack targeted district-issued desktops and laptops utilized by students engaged in remote learning, disrupting educational activities. Croton-Harmon Superintendent Deborah O’Connell confirmed the incident constituted a ransomware attack, a type of breach designed to block organizational access to critical data until a ransom payment is made. The attack compromised operational systems, rendering data inaccessible and interrupting the district’s ability to conduct normal academic functions. Students relying on district devices for remote instruction were directly impacted by the loss of access. The incident occurred at the start of the school week, compounding disruptions to scheduled lessons and administrative operations. Both districts faced parallel challenges in restoring systems, indicating a coordinated or similarly timed attack vector.

District technical teams worked continuously to resolve the breach, a process requiring multiple days to complete. Superintendent O’Connell communicated details of the ransomware attack directly to families via district channels, acknowledging the severity of the operational disruption. The recovery efforts focused on restoring access to encrypted systems and data without specifying whether a ransom was paid or data was recovered through backups. The prolonged remediation timeline underscored the attack’s complexity and the districts’ reliance on compromised devices for remote education delivery. Consequences included not only immediate instructional interruptions but also potential exposure of sensitive information, given the characterization of the event as a data breach linked to ransomware. The incident highlighted vulnerabilities in school infrastructure during a period of heightened dependence on remote learning technologies amid broader cybersecurity threats targeting educational institutions.

Sources

Sources available to members: 1 source.