Fraud Management & Cybercrime
,
Ransomware
Cybercrime History Teaches That Paying a Ransom for Data Deletion Is Foolish
Data breach victim PowerSchool, maker of a widely used K-12 student information system platform, has been attempting to assure schools, students, and their parents and guardians, by saying its attacker has promised to delete the stolen data.
See Also: Live Webinar | 10 Strategies to Tackle Alert Fatigue with Smarter SOC
What’s the old saying about those who fail to learn from history?
California-based PowerSchool earlier this week began warning cloud and on-premises school district users of its K-12 student information system platform that an attacker stole voluminous amounts of student data and has been holding it to ransom. The platform handles everything from enrollment, attendance and communication to staff management, analytics, and finance.
How many school districts and pupils may have been affected remains unclear. In February 2024, then-publicly traded PowerSchool told investors its software supports “over 50 million students globally and more than 17,000 customers, including over 90 of the top 100 districts by student enrollment in the United States, and sells solutions in over 95 countries.” Bain Capital closed a deal last October to acquire the company for $5.6 billion, taking it private.
The stolen information so far appears to include personally identifiable information for at least some U.S. and Canadian students and teachers, including dates of birth and parent contact details, said the New Jersey Cybersecurity and Communications Integration Cell on Thursday. For some school districts, the stolen information may also include “Social Security numbers, personally identifiable information, medical information and grades.”
Don’t worry: PowerSchool said it’s paid the attacker for a promise to delete the data they stole. The attacker even shared a video of the data getting deep-sixed.
Based on messaging sent to parents and guardians seen by Information Security Media Group, PowerSchool told them: “We have taken all appropriate steps to prevent the data involved from further unauthorized access or misuse. We do not anticipate the data being shared or made public, and we believe it has been deleted without any further replication or dissemination.”
After reviewing their logs, both on-premise and hosted PowerSchool customers have reported seeing suspicious activity as early as Dec. 22, 2024, including two tables – Students_export.csv and Teachers_export.csv – being exfiltrated to a Ukrainian IP address. The address, 91.218.50.11, traces to Virtual Systems, a legitimate hosting provider from which the attacker may have directly rented services, or perhaps suborned an existing customer’s account.
PowerSchool told schools that it first learned of the breach on Dec. 28, 2024, after which it hired incident response firm CyberSteward to negotiate with the attacker, according to a copy of a PowerSchool FAQ obtained by cybersecurity blogger Brian Krebs.
Since then, “PowerSchool has received reasonable assurances for the threat actor that the data has been deleted and that no additional copies exist,” including a video of the attacker allegedly deleting their only copy, the FAQ reads.
What Ransomware 101 Teaches Us
If I were to teach a school course on cybercrime – call it Ransomware 101 – here’s what I’d say next: Security experts and government officials continue to urge hack attack victims to never pay criminals for an abstract promise, such as pledging to delete stolen data because there’s no evidence in the history of cybercrime such promises have ever been honored.
Voluminous evidence continues to underscore that online extortionists fail to honor their data-deleting promises. Take the notorious LockBit group. When Britain’s National Crime Agency infiltrated the operation in early 2024, it found, despite the criminals’ promise to delete stolen data for any victim who paid a ransom, they hadn’t deleted a single byte of data since at least December 2022.
And yet many victims of ransomware groups and other extortionists keep paying their attackers. Too often, this suggests such post-breach payments – well and truly after the horse has exited the barn – are attempts by companies to belatedly “do something.” A more uncharitable take is that they’re attempting to apply marketing spin, to make the breach fallout look less bad than it really is.
Unfortunately, paying off criminals buys nothing – except funding criminals. That’s not a great lesson to be getting taught by a K-12 software provider.
Paying off attackers to keep up appearances isn’t new. In 2022, Britain’s data protection authority, the Information Commissioner’s Office, together with the lead U.K. cybersecurity agency, the National Cyber Security Center, warned organizations that paying a ransom doesn’t lessen the risk posed to the stolen data, and won’t lessen in any way organizations’ exposure to government fines.
“It has been suggested to us that a belief persists that payment of a ransom may protect the stolen data and/or result in a lower penalty by the ICO should it undertake an investigation,” the ICO and NCSC said at the time. “We would like to be clear that this is not the case.”
As Bill Siegel, CEO of ransomware incident response firm Coveware – now part of Veeam Software – told me also back in 2022, “you can’t put the toothpaste back in the tube” after data gets stolen. “There’s no way to tell if the threat actor is going to come back and re-extort the organization later on, and in a lot of cases we see, that ends up happening,” he said.
One organization that failed to learn that lesson was Change Healthcare, owned by UnitedHealth Group, which reportedly paid at least one ransom worth $22 million to attackers early last after they stole data pertaining to more than 100 million Americans. Owing to a fallout between the Western attacker and the Russian ransomware group he was affiliated with, the affiliate re-extorted UHG, again threatening to leak the stolen data.
The Change example begs this question: How was PowerSchool protecting its systems? “The threat actor used compromised credentials to access the PowerSource maintenance access tool, which allows IT professionals to access customer SIS instances for support and troubleshooting,” New Jersey’s CCIC said.
An attacker’s ability to use compromised credentials to access a core system makes it sound like PowerSchool wasn’t protecting it using phishing-resistant multifactor authentication. The company didn’t immediately respond to a request for comment.
The lead U.S. cyber agency continues to urge all organizations to use phishing-resistant MFA. The perils of failing to do so continue to be well demonstrated, not least last year by the breach of 165 customers of cloud-based data warehousing platform Snowflake, including Live Nation Entertainment’s Ticketmaster, Santander Bank, the Los Angeles Unified School District and luxury retailer Neiman Marcus (see: Breach-Weary Snowflake Moves to MFA, 14-Character Passwords).
To summarize the lesson: get smart with security before getting breached, and please don’t try and downplay your culpability after the fact, especially by paying attackers for intangible promises.
Any questions, class? This will be on the final.