Hackers seem to have found a new, lucrative target in the form of educational institutions.
In the absence of proper cyber security shields and defence mechanisms, the number of ransomware attacks in this sector has gone up significantly, said a report by Sophos, a British-based security software and hardware company.
The ‘State of Ransomware in Education 2022’ finds that about 60 per cent of the education institutions suffered attacks in 2021 as against 44 per cent in 2020. As many as 73 per cent of them reported a data encryption rate, with 7 per cent of them taking at least three months to recover the data.
“About 97 per cent of higher education and 94 per cent of lower education respondents say attacks impacted their ability to operate,” the report said. It was based on a survey that covered 5,600 IT professionals, including 320 lower education respondents and 410 high education respondents in mid-sized organisations (with 100-5,000 employees) in 31 countries.
Longer recovery time
Higher education institutions have reported the longest ransomware recovery time. While 40 per cent said that it took at least one month to recover, about 9 per cent said it took 3-6 months for the recovery.
“Schools are among those being hit the hardest by ransomware. They’re prime targets for attackers because of their overall lack of strong cybersecurity defenses and the goldmine of personal data they hold,” said Chester Wisniewski, Principal Research Scientist at Sophos.
“Education institutions are less likely than others to detect attacks that are in progress. Considering the encrypted data is most likely confidential student records, the impact is far greater than what most industries would experience,” he said.
“Four out of 10 schools say fewer insurance providers are offering them coverage, while nearly half (49 per cent) report that the level of cybersecurity they need to qualify for coverage has gone up,” Wisniewski said.
The cybersecurity firm asked the academic institutions to install and maintain high-quality defenses across all points in the environment. “You need to review security controls regularly and make sure they continue to meet the organisation’s needs,” it said.
“Proactively hunt for threats to identify and stop adversaries before they can execute attacks will help minimise risks,” it said. “You should make backups and practice restoring from them to ensure minimise disruption and recovery time.”
Published on
July 15, 2022
