It is not only schools in the US and the UK that have been affected by ransomware. A report from Minamiboso City in the Shiba Prefecture of Japan announced that the network used by the city’s primary and secondary schools had been attacked by ransomware.
On July 19, the Minamiboso City Board of Education confirmed unauthorized access to the school business network:
On July 17, 2020, the Minamiboso City Board of Education confirmed unauthorized access by a malicious third party to the school affairs network used by elementary and junior high schools. The attack caused the server to fail and is now out of service. We are confirming with the police and outsourced companies whether the information of children/students has been leaked due to unauthorized access. (machine translation)
The city’s contractor confirmed the ransomware attack at 3:30 am on July 17. A threatening note in English was reportedly left on the server, telling the school network personnel to contact the attackers, but the type of ransomware was not disclosed publicly.
The attacked server is used for faculty, staff, and student matters. It also stores children’s and students’ personal information such as their address, name, parent contact information, grades, height and weight of students, and attendance information for six primary and six secondary schools of 1,293 children and 724 pupils.
Because the threat actors encrypted the system, grades, and letters for students could not be handed out on July 20 for closing ceremonies for the school year. Some schools reportedly handed out notes on paper.
Although the ransomware group threatened to post report cards and other information on the internet if their demands were not paid, the Minamiboso City Board of Education announced that it would work on its own without paying money and would restore the facilities in September.
One news outlet has reported that the attack is believed to be an attack by “Lockbit 3.0.” If that’s the case, LockBit would likely list the school network or city on its “name and shame” leak site. DataBreaches can find no such listing when we checked this week. An inquiry to LockBitSupp on Tox asking if LockBit is claiming responsibility for this attack has not been answered as yet.
At present, then, DataBreaches has found no data leak from this attack but will update this report if the situation changes or more information becomes available.
Editing by Dissent