LockBit 3.0 Ransomware Attack on EVW School District
Ransomware Attack on EVW School District by LockBit 3.0
Victim Profile
The Eden Valley-Watkins Independent School District #463, located in Eden Valley, Minnesota, is a public school district serving students in Eden Valley, Watkins, and surrounding areas. The district operates one elementary school and one secondary school, offering a wide range of educational programs and extracurricular activities to support student development.
Company Size and Industry Standing
The school district is a prominent educational institution known for its high standards and rigorous academic, arts, and athletic programs. The district's commitment to personalized learning opportunities, mental health programs, and community engagement sets it apart in the education sector.
Attack and Vulnerabilities
The LockBit 3.0 cybercrime group targeted the EVW School District in a ransomware attack, exfiltrating 19 GB of data, including invoices, financial records, and other documents. While no specific ransom demand was issued, the attackers leaked a sample of the exfiltrated data, highlighting the severity of the breach. The district's reliance on digital systems for administrative and educational purposes could have made it vulnerable to ransomware attacks like the one carried out by LockBit 3.0.
Ransomware Group Distinction
LockBit 3.0, also known as LockBit Black, is a sophisticated ransomware group that has evolved from previous iterations to become more modular, evasive, and dangerous. The group's use of obfuscation techniques, lateral movement capabilities, and Ransomware-as-a-Service model make it a significant threat to organizations across various industries, including education.
LockBit May Attacks
This is part of the May 2024 attacks by LockBit 3.0, a cybercriminal group that resurfaced with vigor following the disruption of its infrastructure in February during "Operation Cronos." Despite arrests and the dismantling of its data leak site, LockBit swiftly returned, targeting over 50 victims within hours of reactivating its platform. The recent activities of LockBit targeted diverse industries globally, with manufacturing companies, professional services, and the ICT sector being the most affected.
Sources:
See Halcyon in action
Interested in getting a demo?
Fill out the form to meet with a Halcyon Anti-Ransomware Expert!