In cyberterrorism case, school offers identity protection service

In the wake of a “cyberterrorism” attack last fall, School District 6 recently offered a free year of a service that helps people keep track of and stop possible identity theft on the Internet.

In September, foreign hackers, known as TheDarkOverlord Solutions were able to break into school servers and steal personal information from both current and prior staff as well as about 700 students.

They first sent threatening text messages to school administrators, some teachers, parents and local police. Schools across the Flathead Valley shut down for several days as a result.

The hackers then tried to hold the school ransom, demanding it pay more than $100,000 or it would release the information.

But five months later, the hackers have moved on and the school never paid the ransom.

“They supposedly sent an email that they were through with us,” superintendent Steve Bradshaw said last week. “But I don’t trust anything they put out ... I think they’re finding out that schools don’t have a lot of money.”

Local law enforcement and the FBI both worked on the case. When it first happened, it drew national interest, noted Columbia Falls Police Chief Clint Peters. He said he received calls from several national news organizations, including the Wall Street Journal and NBC.

Now, as a precaution, the school is offering a year-long free subscription to Experian’s IdentityWorks. The product helps detect possible misuse of personal information and provides a subscriber with identity protection support focused on immediate identification and resolution of identity theft. The school does not gather or store student Social Security numbers in most cases, but it does have Social Security numbers of employees on file.

It also has some student Social Security numbers and some parent Social Security numbers on file if the student received federal aid, like Medicaid.

All told, the school estimates that about 650 employees may have had their information stolen and about 700 students.

Since the hack, the school has taken measures to secure its servers. That includes a “freeze” of data each night, so that if hackers try to again, the school won’t lose all its information.

Another common tactic of hackers is to break into servers, seize the data and then seek a ransom from the victim for them to get it back.

The school has also established a call center for people if they have any questions on whether they may have their information compromised. They can call 1-866-329-9387, Monday through Friday, 7 a.m. to 5 p.m. mountain time.

Bradshaw said the school’s insurance was covering the cost of the cyberattack. He said without it, the school would have seen a significant expense associated with the incident.