The clock is ticking on ransomware attack on Providence schools • Rhode Island Current

There are six days left before a hacker group threatens to release over 200 gigabytes of data stolen from the Providence Public Schools Department (PPSD) unless the troubled school district pays a $1 million ransom.

The hacker group Medusa claims responsibility for the alleged data theft, which apparently includes a cache of parents’ emails, phone numbers and addresses, as well as driver’s licenses and identification information from district employees’ work cell phones (as of January 2024).

The potential data leak came a week after the district sent a letter to the PPSD community on Sept. 12 noting “irregular activity” on the school district’s network. The district hired an outside IT company to determine next steps, and then shut down internet access in all district schools and offices to prevent further damage. As classrooms returned to traditional instruction, a forensic analysis of the suspicious activity began.

“IT staff followed appropriate security protocols and worked to isolate the issue, which has now been contained,” the letter said. “The school’s security systems and protocols remain active while classes continue.”

Superintendent Javier Montañez provided an update in a Sept. 16 letter: “Currently, all Internet-connected systems remain down while IT professionals are working diligently to assess the network and determine next steps for a quick resolution. … We would like to emphasize that at this time, there is no indication that PPSD data has been impacted.”

In another letter dated September 16, Montañez wrote: repeated that “initial findings did not indicate that the district’s data had been compromised.”

GoLocal Prov and national technology news portal Comparitech have reported the ransomware group Medusa as the culprit. And on Wednesday morning, Providence School Board President Erlin Rogel issued a statement saying the board would meet with Montañez in closed session Wednesday evening during a regular session.

“The Providence Public School District has experienced a network security breach and the school district intends to address it immediately,” Rogel said Wednesday morning.

“Tonight we are meeting in board meeting to hear from the superintendent how the breach occurred, what steps are being taken to remediate it, and how we will support students and families during the outage. We also want to hear what liability our network security provider has and what steps are being taken to ensure this does not happen again.”

“As is our practice, the district and its professional third-party IT agency contacted the RI State Police, Federal Bureau of Investigation (FBI) and Department of Homeland Security (DHS) last Wednesday,” PPSD spokesman Jay G. Wégimont said in an email Wednesday. “Please note that this was also done out of an abundance of caution and that analysis is ongoing.”

The Rhode Island Department of Education, which oversees Providence schools, is aware of the situation and is “working closely with the district,” said spokesman Victor Morente.

“To our knowledge, a forensic analysis of the network is currently underway, which will provide further information on the incidents,” Morente said. “That is all we have at this time.”