Back to threat feeds
Cyberattack
Rhysida Group Targets Major US School District in Cryptic Attack
Major US school district hit by Rhysida ransomware attack, sensitive data auctioned.
Continue reading
Major US school district hit by Rhysida ransomware attack, sensitive data auctioned.
Continue reading
Threat landscape has once again witnessed a newly emerged Rhysida ransomware group claiming responsibility for the ransomware attack on one of the largest school districts in the United States. The victims of this audacious assault are the Prince George's County school systems in Maryland.
In a calculated move that carries a sinister undertone, Rhysida added the Maryland school district to its dark leak site just three days before the commencement of the 2024-25 school year. With Prince George's County Public School System (PGCPS) being ranked amongst the nation's top 20 largest districts, the implications of this breach reverberate far beyond its physical confines.
*Dark Leak Site*
As the sun rose on August 14th, the Prince George's County school district encountered a devastating cyberattack. While the specifics of the breach remain under scrutiny, initial assessments indicate that approximately 4,500 user accounts out of 180,000 were compromised. Most of the affected accounts were staff-related. However, the repercussions extended beyond the initial breach.
The severity of the breach deepened as the Rhysida group shockingly made sensitive data from the compromised accounts available for purchase on their leak site. What is the price of admission into this digital underworld? A staggering 15 Bitcoins, equating to around $390,000 USD. A chilling glimpse into the illicit world of ransomware, the breach highlights the increasing audacity of such attacks.
In a bizarre twist, Rhysida seems to be orchestrating a digital auction for the stolen data. Passports, driver's licenses, and other confidential information are reportedly on the bidding block. The group has taken an exclusive stance, with intentions to sell to only one buyer—emphasizing the secretive and sinister nature of their operations.
In the aftermath of the attack, Prince George's County Public School system embarked on an arduous journey to restore normalcy. Collaborating with cybersecurity experts, they launched a thorough investigation into the breach. While no specific misuse of information has been identified yet, the school district acknowledges the typical data breach repercussions that often follow such cyber onslaughts.
As PGCPS grappled with the breach, Rhysida's dark leak site hosted a chilling countdown. The digital ticking clock accentuated the urgency of their auction. Bidders were urged to seize this fleeting opportunity to purchase unique and exclusive data—a stark reminder of the eerie underbelly of the digital realm.
Swift action followed in the wake of the breach, with PGCPS mandating password resets for all system users. Students are not immune either, facing password resets during the commencement of the school year. While the main business and student information systems appear unscathed, the incident underscores the importance of fortified cybersecurity defenses.
Located in the Washington DC Corridor, Prince George's County school district boasts over 200 schools and centers, with more than 133,000 students and nearly 20,000 employees. The ripple effects of this breach extend well beyond the digital realm, underscoring the vulnerability of even the most prominent educational institutions.
Cybernews, a prominent player in the cybersecurity domain, has reached out to PGCPS for insights and comments on the unfolding developments. The response from the district holds the potential to provide further context to this evolving cyber narrative.
The shadowy threat actor, Rhysida, has recently emerged on the ransomware scene. With its ominous presence felt since late May, the group's activities have been placed under the microscope by US government officials. This heightened scrutiny follows the group's claim of responsibility for a debilitating ransom attack on California-based healthcare conglomerate Prospect Medical Holdings (PMH).
Earlier this week, Rhysida struck a crippling blow against the healthcare sector, impacting Prospect Medical Holdings (PMH). Hospitals and medical facilities in Connecticut and Pennsylvania were thrown into disarray, forced to suspend services and divert patients for days. The cascading effect of this attack lays bare the critical vulnerability of healthcare institutions in the face of modern cyber threats.
Rhysida's audacity was on full display as it staged a live auction on its dark leak site, offering up more than 2.3 terabytes of allegedly stolen sensitive data from the PMH attack. The allure of the auction, including an entire SQL database, serves as a chilling reminder of the sophistication and determination that characterize modern cybercriminals.
The reach of Rhysida's menace extends further. Washington State's Pierce College fell prey to the same threat actor, facing the same ominous fate. The group allegedly charged 10 Bitcoins to access the stolen data. This escalating situation reveals a growing trend—one that leaves educational institutions vulnerable to the ever-present threat of ransomware.
DHS confirms a breach of its HSIN intelligence-sharing network during World Cup security operations; a senator warns of national security risk
