Steve Gibson (134:37)
So when the Medusa ransomware gang attacked Minneapolis public schools in February 23, it stole reams of sensitive information and demanded four and a half million dollars in bitcoin in exchange for not leaking it. District officials had a lawyer at Mullen Coughlin notify the FBI. So at the same time, officials were not acknowledging publicly that they had been hit by a ransomware attack. Their attorneys were telling federal law enforcement that the district immediately determined its network had been encrypted, promptly identified Medusa as the culprit, and within a day had its, quote, third party forensics investigation firm communicating with the gang regarding the ransom. Mullen Coughlin then told the FBI that it was leading a privileged investigation into the attack and that the school and at the school district's request, quote, all questions, communication and requests in connection with this notification should be directed to the law firm. Mullen Coughlin did not respond to requests for comment. Minneapolis school officials would wait seven months before notifying more than 100,000 people that their sensitive files were exposed, including documents detailing campus rape cases, child abuse inquiries, student mental health crises and suspension reports. As of December 1st, all schools in Minnesota are now required to report cyber attacks to the state, but that information will be anonymous and not shared with the public. One district took such a hands off approach, leaving cyber attack recovery to the consultants discretion, that they were left out of the loop and forced to later issue an apology. When an April 23 letter to Camden educators arrived 13 months after a ransomware attack, it caused alarm. An administrator had to assure employees that the New Jersey district wasn't the target of a second attack. The letter was about the one. More than a year ago, the attorneys had sent out notices after a significant delay and without the school's knowledge. Other school leaders said when they were in the throes of a full blown cyber crisis and ill equipped and ill equipped to fight off cybercriminals on their own. Law enforcement was not of much use and insurers and outside consultants were often their best option. Ron Ringlestein, the executive director of technology at the Yorkville, Illinois school district, said, in terms of how law enforcement can help you out, there's really not a whole lot that can be done, to be honest. Unquote. When the district was hit by a cyber attack prior to the pandemic, he said in a report, the FBI went nowhere. Instead, district administrators turned to their insurance company, which connected them to a breach coach who then led all aspects of the incident response. Under attorney client privilege. Northern Bedford County School Superintendent Todd Beatty said the Pennsylvania district contacted the CISA to report a July 2024 attack, but, quote, the problem is there's not enough funding and personnel for them to be able to be responsive to incidents, unquote, and too many incidents. Meanwhile, John Van Wagoner, the school superintendent in Traverse City, Michigan, claims insurance companies and third party lawyers often leave district officials in the dark, too. Their insurance company presented school officials with the choice of several cybersecurity firms they could hire to Recover from a March 2024 attack, Van Wagener said. But he, quote, did know where to go to vet if they were any good or not, unquote. He said it had been a community member, not a paid consultant, who first alerted district officials to the extent of the massive breach that forced school closures and involved 1.2 terabytes of stolen data. Breach notices and other incident response records obtained by the 74 show that a small group of law firms play an outsized role in school cyber attack recovery efforts throughout the country. Among them is McDonald Hopkins, where Michigan attorney Dominic Paloozzi co chairs a 50 lawyer data privacy and cybersecurity practice. Some call him a breach coach. He calls himself a quarterback. After establishing attorney client privilege, Paloozi and his term called in outside agencies covered by a district cyber insurance policy, including forensics analysts, negotiators, public relations firms, data miners, notification vendors, credit monitoring providers and call centers. Yeah, and who pays for this? The taxpayer. Across all industries, the CyberSecurity practice handled 2,300 incidents in 2023, 17% of which involved the education sector, which Paloozi noted is not quite always the best when it comes to the latest protections. When asked why District's initial response is often to deny the existence of a data breach, Paloozi said, well, it takes time to understand whether an event rises to the level that would legally require disclosure and notification. Paloozi said it's not the time to make assumptions to say we think this data has been compromised until we know that if we start making assumptions, that starts our clock on legally mandated disclosure notices, we're going to have been in violation of a lot of the laws. And so what we say and when we say it are equally important, which is why there are so many jokes about attorneys, of course, in other words, finessing the system. They said, you know, once we've acknowledged that a breach has occurred, notification requirement clocks start ticking. So the longer we wait to acknowledge, apparently even to themselves, that anything more serious than an incident is being investigated, the better, he said. In the early stage, lawyers are trying to protect their client and avoid making any statements they would later have to retract or correct. Uh huh, pelosi said. Quote while it often looks a bit canned and formulaic, it's often because we just don't know and we're doing so many things we're trying to get it contained, ensure the threat actor is not in our environment and get up and running so we can continue with school and classes and then we shift to whatever data is potentially out there and compromised. A data breach is confirmed, he said. Only after a full forensic review, a process that can take up to a year and often only after it's completed are breaches disclosed and victims notified, he said. We run through not only the forensics, but through the data mining and document review effort. By doing that last part, we're able to actually pinpoint for John Smith that it was his Social Security number, right, and Jane Doe that it's your medical information, he said. We try in most cases to get to that level of specificity and our letters are very specific. Sounds like a lot of billable hours to me. Makes you sort of wonder whether the cure is more, you know, is worse than the disease. According to they wrote a 2023 blog post by attorneys at the firm Troutman Pepper Lock, targets that respond to cyber attacks without the help of a breach coach often fail to notify victims and in some cases provide more information than they should. When entities over notify, they increase the likelihood of a data breach class action lawsuit in the process. Companies that under notify may reduce the likelihood of a data breach class action, but could instead find themselves in trouble with government regulators. Wow, what a mess. For school districts and other entities that suffer data breaches, legal fees and settlements are often among their largest expenses. Yeah, that's a shock. Law firms like McDonald Hopkins that manage thousands of cyber attacks every year are particularly interested in privilege, said Schwartz, the University of Minnesota law professor who wonders whether lawyers are necessarily best positioned to handle complex digital attacks. In his 2023 Harvard Journal report, Schwartz writes that the promise of confidentiality is breech coach's chief offering. The report argues that by inflating the importance of attorney client privilege, lawyers are able to retain their primacy in the ever growing and lucrative cyber incident response sector. Similarly, he said, lawyers emphasis on reducing payouts to parents who sue overstates schools actual exposure and is another way to promote themselves as providing a tremendous amount of value by limiting the risk of liability by providing a shield their efforts to lock down information and avoid paper trails, he wrote, ultimately undermine the long term cybersecurity of their clients and society. More broadly, school cyber attacks have led to the widespread release of records that heighten the risk of identity theft for students and staff and trigger data breach notification laws that typically center on preventing fraud. Yet files obtained by the 73 show School Cyber attacks carry particularly devastating consequences for the nation's most vulnerable youth. Records about sexual abuse, domestic violence, and other traumatic childhood experiences are found to be at the center of leaks, and hackers have leveraged these files in particular to coerce payments. In Somerset, Massachusetts, a hacker using an encrypted email service extorted school officials with details of past sexual misconduct allegations during a school show choir event. The accusations were investigated by local police and no charges were filed. The hacker threatened school officials and records obtained by the 74 by writing, quote, I am somewhat shocked with the contents of the files because the first file I chose at random is about a predatory pedophilia incident describing described by young girls in one of your schools. This is very troubling even for us. I hope you have investigated this incident and reported it to the authorities because that is some messed up stuff and he didn't say stuff. If the other files are as good, we regret not setting a higher price, unquote. Danielle Citron, a University of Virginia law professor, argues that a lack of legal protections around intimate data leaves victims open to further exploitation. She notes that the exposure of intimate records presents a situation where vulnerable kids are being disadvantaged again by weak data security. And of course, keeping all of this secret and in the dark doesn't improve data security. Danielle said, it's not just that you have a leak of information, but the leak then leads to online abuse and torment. Meanwhile, in Minneapolis, an educator reported that someone withdrew more than $26,000 from their bank account after the District got hacked. In Glendale, California, more than 230 educators were required to verify their identity with the IRS after someone filed their taxes fraudulently. In Albuquerque, where school officials said they prevented hackers from acquiring students personal information, a parent reported being contacted by the hackers who placed a strange call demanding money for ransoming their child. Nationwide, 135 state laws are devoted to student privacy, yet they are all unfunded mandates with no enforcement. All 50 states have laws that require businesses and government entities to notify victims when their personal information has been compromised. But the rules vary widely, including definitions of what constitutes a breach, the types of records that are covered, the speed at which consumers must be informed, and the degree to which the information is shared with the general public. It's a regulatory environment that breach coach Anthony Hendricks with the Oklahoma City law firm Crow and Dunleavy, calls the multiverse of madness. Hendricks said. It's like you're living in different privacy realities based on the state you live in, he said. Federal cybersecurity rules could provide a level playing field for data breach victims who have fewer protections because they live in a certain state. By 2026, proposed federal rules could require schools with more than 1,000 students to report cyber attacks to CISA. But questions remain about what might happen to the rules under the new Trump administration and whether they would come with any accountability for school districts or any mechanism to share those reports with the public. Corporations that are accused of misleading investors about the extent of cyber attacks and data breaches can face securities and Exchange Commission scrutiny. Yet such accountability measures are missing from public schools. The Family Educational Rights and Privacy act, the federal student privacy law prohibits schools from disclosing student records, but does not require disclosure when outside forces cause those records to be exposed. Schools having a policy or practice of routinely of routinely students records in violation of ferpa, that's the Family Education Rights and Privacy act, can theoretically lose their federal funding, but no such sanctions have ever been imposed since the law was enacted in 1974. The patchwork of data breach notifications are often the only mechanism alerting victims that their information is out there. But with the explosion of cyber attacks across all aspects of modern life, they've grown so common that some see them as little more than junk mail. Schwartz, the Minnesota law professor, is also a Minneapolis Public Schools parent. He told the 74 he got the district's September 2023 breach note in the mail, but he, quote, didn't even read it. The vague notices, he said, are mostly worthless. It may be enforcement against districts misleading practices that ultimately forces school systems to act with more transparency, said Attai, a data privacy consultant. She urges educators to communicate very carefully, very deliberately and very accurately the known facts of cyber attacks and data breaches. So, Leo, this is all a big mess. Yeah, no kidding. When an enterprise's security is breached and its proprietary data are leaked, details of its internal operations, employees and customers, as we know, can become public.
