Ransomware affects T. Falls school district

Ransomware impacted the server at Thompson Falls Schools last week and the school and law enforcement agencies are working to resolve the problem.

The event was discovered last Wednesday, September 4. The school contacted local law enforcement, who then contacted other agencies to assist. Superintendent Bill Cain said they also contacted their insurance company and legal advisors regarding the matter.

Cain said they have been working nonstop with experts on the data security event. It was not clear as of Tuesday if any data had been taken from the school server.

“Certainly, we will be transparent through this entire process,” Cain said Monday. “We know the concern of private information and we have no indication at this time that any data has been taken.”

Ransomware, according to the Department of Homeland Security, is a type of malicious software designed to deny access to a computer system or data until a ransom is paid. Ransomware, according to us-cert.gov, normally spreads through phishing emails or by unknowingly visiting an infected website. The school district did not say whether or not a ransom had been demanded in this incident.

Local law enforcement were not available for comment on the Thompson Falls matter.

Bill Naegeli, Emergency Manager for Sanders County, said that the county was notified of the school issue. He said if it would have been all school systems in the county affected, the commissioners could have signed an emergency declaration to offer more support. But because only one school district was affected, the county just helped notify other school districts to make them aware.

Naegeli said that whenever there is a cyber incident, the FBI is notified. “It’s a wake-up call for us and the state because school systems are unique,” Naegeli said. “They aren’t a subdivision of the state, where disaster and emergency services can assist. It’s a learning curve for all of us on where we can assist and how we can help school districts get through this type of situation.”

Naegeli noted that when the Columbia Falls School District was affected by ransomware in 2017, people were specifically targeted and emergency personnel knew what information was taken.

“Here, we do not know what files are being held for ransom or how far they have gotten into it. That’s what the expert forensics teams are here working on,” Naegeli said. He added that the state requested help through the state, who sent a cyber unit to assist the school in reformatting the computers and helping get the school back online.

Cain noted they don’t know the extent of the issue and that more information will be made available as the investigation continues.

“We hope to have things restored as soon as possible,” the superintendent said at the school board meeting on Monday. “We will make sure we get up and running and our data is secured.”