Cyber Incident Victim: Mobile County Public Schools
Date:
Sep 2019
Location:
United States of America
Summary
Mobile County Public Schools experienced operational disruption due to a ransomware attack targeting their third-party vendor, SchoolinSITES. The incident caused the district's website to be offline for approximately 24 hours before services were restored. The attack created confusion through rapidly changing system status updates during the outage period, though normal operations resumed following remediation efforts focused on the vendor's compromised systems.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Mobile County Public Schools in Alabama experienced a disruption to their online services beginning on or around September 24, 2019, due to a ransomware attack targeting their third-party vendor, SchoolinSITES. The incident caused the school district’s website to go offline for approximately 24 hours, creating operational confusion as the status of systems fluctuated rapidly during the outage. While the attack did not directly breach the school district’s infrastructure, the dependency on SchoolinSITES’ services resulted in collateral downtime affecting public access to the district’s digital resources. No specific details regarding the ransomware variant, initial attack vector, or scope of encryption within the vendor’s systems were disclosed in available reporting. The disruption demonstrated the operational risks associated with third-party service dependencies during cybersecurity incidents.
The school district’s website resumed normal operations after the 24-hour downtime period, though the timeline and methods of recovery employed by SchoolinSITES were not publicly elaborated. Mobile County Public Schools did not report evidence of data exfiltration or unauthorized access to their own systems stemming from the vendor incident. The primary impact remained confined to temporary loss of website availability, with no indication of prolonged technical or financial consequences for the district. The vendor’s remediation actions, including whether a ransom payment occurred or external cybersecurity assistance was engaged, were not disclosed in the immediate aftermath. Public reporting emphasized the restoration of services without further elaboration on forensic findings or long-term mitigation measures implemented by either the vendor or the school system.