Hackers are targeting schools, U.S. Department of Education warns

When Superintendent Steve Bradshaw first received a threatening text message in mid-September, he didn't know it was coming from a hacker trying to exploit his Montana school district.

Advertisement

But soon, students and other schools around Flathead County were receiving threatening messages, too. More than 30 schools in the district shutdown for three days.

"The messages weren't pleasant messages," Bradshaw said. "They were 'splatter kids' blood in the hallways,' and things like that."

The U.S. Department of Education is now warning teachers, parents, and K-12 education staff of a cyberthreat targeting school districts across the country.

So far, at least three states have been targeted by the extortion attempt from hackers asking schools to give them money or the group will release stolen private records, according to the department.

"In some cases, this has included threats of violence, shaming, or bullying the children unless payment is received," the department wrote in an advisory this week.

Bradshaw, the superintendent of schools in Columbia Falls, Montana said a hacking group broke into multiple school servers and stole personal information on students and possibly staff. He said after the threatening messages came, hackers asked for ransom.

In a ransom note sent to a number of Columbia Falls school district members and released by the county's sheriff's department, the hacking group called the Dark Overlord threatened the district and demanded up to $150,000 in bitcoin to destroy the stolen private data.

The threatening letter talked about use of force, mentioned the name "Sandy Hook," the elementary school in Connecticut where 20 small children and six adults were shot dead, and said victims would suffer financial and reputational damage.

Law enforcement said they did not believe the threats and determined the attackers were located outside of the U.S.

"We feel this is important to allow our community to understand that the threats were not real, and were simply a tactic used by the cyber extortionists to facilitate their demand for money," the Flathead County Sheriff's Office said in a Facebook post last month.

Bradshaw said the district is not paying the ransom, and he is still receiving threatening messages.

The same hackers also targeted the Johnson Community School District in Iowa earlier this month, and the district canceledall classes on October 3. According to local media reports, the hackers also sent threatening text messages to children and their parents.

The hacking group previously attempted to extort Netflix (NFLX, Tech30) after hacking its production studio, Larson Studios. The group released episodes of Orange is the New Black online last spring.