The estimated costs cover a wide range of programs, services, trainings and licenses that helped Maryland’s third-largest school system respond to and recover from the attack, which took place the day before Thanksgiving and canceled two days of online classes for 111,000 students.
The district has said no personal information was stolen, but has not disclosed the extent of the attack nor any ransom demands.
Among the largest expenditures was more than $2 million to move computer applications to a cloud-based system and more than $1.4 million for a one-year license on Windows security software, the latter of which was purchased at the strong recommendation of the system’s cyber insurance carrier.
Executive director for fiscal services George Sarris projected the final price tag could top more than $8 million, he said during a school board meeting Tuesday. Sarris was not available for comment this week.
Baltimore County school board had previously approved four contracts representing $1.7 million in services related to the ransomware attack.
The updated figure places the county much closer to what Baltimore City spent on recovery from its own ransomware attack in 2019. The city spent about $10 million on recovery efforts, not including a $8.2 million loss in revenues such as taxes, fees and fines.
Unlike the city, Baltimore County school system was paying for cyber insurance at the time of the attack. The system’s policy covers up to $2 million for direct costs caused by the ransomware attack and $3 million for liability costs.
Some of the remaining bills can be paid out of the system’s current budget and federal CARES Act funding, Sarris said during a school board budget committee meeting in April.
Still, the attack has delayed at least one major project school staff were working on this year.
Staff and contractors were on track to complete a payroll project that would allow employees to receive their paychecks over the course of a full calendar year instead of the typical 10-month school year. Administrators asked the school board Tuesday for permission to set a new target for rollout during the 2022-23 academic year.
Another major system lost in the attack was the timekeeping program that allows the district to track employee hours and overtime. Officials estimate it will cost $800,000 to restore the system.
©2021 Baltimore Sun. Distributed by Tribune Content Agency, LLC.
