On June 17, information system staff interrupted and stopped an attack on the department’s computer system before hackers could fully access the system or lock it, according to State Superintendent Eric Mackey. He said staff were able to restore all system data with backups, but there is a possibility that some data was compromised.
Officials have launched an ongoing criminal investigation and are working with federal and state law enforcement, the Alabama Attorney General, the Alabama Office of Information Technology and an independent anti-hacking expert to assess the scope of the attack.
“Like others that have been hit, other public schools, agencies, hospitals and businesses, this has become unfortunately almost commonplace across our country where these foreign criminal syndicates attack American institutions like they attacked ours,” Mackey said. “And while this is disheartening and disappointing, we are not wanting to negotiate with foreign actors or extortionists, and we’ve made that very clear.”
There were 1,619 publicly disclosed cyber attacks on schools between 2016 and 2022, according to the nonprofit K12 Security Information Exchange. The organization counted over a dozen malware or ransomware attacks in Alabama school districts during that time period.
Mackey said the department could not specify which data was breached in June, but encourages students and state and local education employees to be on alert. The state department does not collect direct deposit information, but may house Social Security numbers or other identifiable information.
“To all parents and to all local and state education employees out there, they should monitor their credit and they should assume that there’s a possibility that some of their data were compromised,” Mackey said.
Teacher certification processing also slowed down, Mackey said, due to recent work on the department’s servers. But all services are now back up and running.
Mackey said the department is taking additional measures to improve cybersecurity, but declined to go into detail about those protocols. He also declined to comment on any system vulnerabilities behind the attack.
“Down the road, that may be something that can be shared, but again we’re following the lead of federal investigators,” he said.
Updates on the data breach can be found at alabamaachieves.org/databreach and any questions or comments can be directed to databreach@alsde.edu.
The state department’s website, alabamaachieves.org, will be down for a few hours starting at 5 p.m. July 3 for some previously scheduled updates.
©2024 Advance Local Media LLC. Distributed by Tribune Content Agency, LLC.
