At Panama-Buena Vista Union School District, all phones and windows-operated computers were attacked by ransomware.
The initial attack occurred last Thursday night.
One week later, the district is still working with FBI and Homeland Security to safely get its data back.
The District serves 23 schools and nearly 16,000 students.
“The FBI has confirmed Trickbot was the dropper or delivery system of this malware attack,” said assistant superintendent Gerrie Kincaid.
Per the name, a ransomware attack typically asks for a ransom.
“Your data, your intellectual property, your personal information, as well as the company’s information is held hostage, and you no longer have access to it. Or, you have to pay to get it back,” said ransomware expert Nick Points, with ARRC Technologies in Bakersfield.
In the case of the PBVUSD, “the FBI advised us not to pursue that link or that email that would’ve presented that demand, so we know of no demand,” Kincaid said.
According to an email from Superintendent Dr. Kevin Silberberg to parents, the attack means there is no access to Internet, phones, or Microsoft programs like Word or PowerPoint on school computers.
The system to email teachers is also down.
Report cards will be delayed for a few weeks, and student grades are not available online.
In addition, teachers will be paid with paper checks.
However, the district says all personal information is safe, though not accessible.
“We do have a very strong backup, and that’s why we believe none of our student or employee information has been compromised,” Kincaid said. “Just getting access to the system for doing so, we have to make sure that is clean.”
If they ultimately can’t access their information safely, Points explained, “You start from scratch. You have to rebuild your database, put all your client information back in, payroll, invoicing, account information, personal information.”
In the meantime, the district is working old-school.
Teachers have been creating lesson plans manually.
Schools are using Parent Square, a cloud-based platform to communicate with teachers.
The district does not know how long it must continue to operate like this.
“I want to be very clear that this is going to be a very slow, very deliberate process,” Kincaid said. “This incident has compelled us to more carefully examine our internal controls and network security, and we will be much stronger as a result.”
The district says dismissal times, payroll deadlines, and school schedules are not affected.