Newfound school district still working to recover data after cyber attack

BRISTOL — Newfound Area School District is recovering from a Nov. 15 cyber breach, described as a ransomware attack because it locked users out, although the unknown hacker did not make a financial demand.

Jason Sgro, a senior partner at the Atom Group, the cyber response company based in Portsmouth working to restore the computer network, told members of the school board that most functions, including printing, should be restored by Dec. 15. He said the timeline for restoring financial data at the central office “is definitely still in question. That will be a massive effort.”

The business office is using spreadsheets to handle work such as payroll and purchasing while the Atom Group works to rebuild the lost data.

Most classroom operations had been restored as of Dec. 11, but the printing of documents remained impossible, and wireless access will continue to experience disruptions while the team works to recover other services, Sgro said.

The ransomware entered the system through a laptop and infected the computers at five schools and the central office.

“It was scheduled for automatic detonation on Monday the 20th, which is the day that I’m sure most of you became aware that there was an issue at the schools and the school network,” Sgro said.

Atom Group made a full forensic evaluation and “sandboxed” the malware, moving it to a virtual environment where it could be tested and analyzed without causing harm to the host system. The group also attempted to reach the “threat actor” who installed the malware.

Sgro said they found no evidence that any personally identifiable or financial information had been breached or seen by the threat actor, and students’ computers were not impacted. Student information was not on the servers, having been stored in the cloud.

“So it hasn’t gotten any major impact really, outside of your staff,” Sgro told the board. “It has been over nine days now since our last reported infection in any of the schools, so we are not seeing the spread of any new infection.”

Laptop and desktop computers that were pulled from use will be cleansed over the next couple of weeks before being put back into service, he added, saying the attack had affected only software, with no damage to any hardware.

“We will be monitoring both darkweb as well as your external infrastructure throughout the recovery effort, until we recertify the environment as being fully operational, which will come at the very end of this,” Sgro said.

Wellness policy

The school board is taking a fresh look at its proposed expansion of the wellness policy that would include referring students to outside services for psychological counseling. More than 30 residents protested the changes at the Nov. 27 meeting.

Lead organizer Marie Carson of Alexandria returned on Dec. 11 to address comments by student representative Mika Austin, who had cited statistics that 18.1% of the students had made a plan to commit suicide.

“I completely agree that the inhumane treatment students endured during COVID left students feeling anxiety, depression, and even suicidal,” Carson said. “A great deal of the current feelings of anxiety, depression and suicide among our students today are the result of how this board blindly implemented COVID procedures.”

Carson called upon the school board to “apologize to the whole student body for their careless decisions that caused students to endure enormous amounts of emotional distress” by following the scientific consensus and guidance from the Centers for Disease Control and Prevention instead of listening to members of the public who did their own research on the internet.

“Since the school board ignored the concerns of the community, refused to research the topic and then govern in the best interest of the students during COVID, we certainly don’t want the school to expand its authority over students’ health care,” she said.

When the COVID-19 pandemic began, leaders focused on slowing down its spread until there was an effective vaccine. Available scientific data at the time showed that masks could accomplish that, although only surgical masks were effective in blocking the virus. N95 masks were in short supply so they were reserved for symptomatic, ill individuals and health care workers.

Although the World Health Organization originally discouraged the use of most available masks as being ineffective, it changed its recommendation in June 2020, and the CDC followed suit. Most school boards followed that advice, in part because their federal grants required it.

It was only later that research confirmed the arguments by some dissident scientists that extended mask-wearing could result in self-contamination and cause breathing difficulties. Other studies showed that student masking hampered education and increased feelings of isolation.

Bristol Rep. John Sellers (R) said, “We’re not saying we’re going to get rid of all the [health] services; that’s just ridiculous. But since the [social-emotional learning] program does have a deeper, darker-rooted agenda going on there, what we’re trying to say is, the kids, the students, and going forward into the future ... you’re doing assessments ... someone’s collecting that data ... but that data could eventually follow the student the rest of their life. And some of the stuff you do not want following you the rest of your life because you may have had one bad day, or I’ve made a stupid mistake going through school. So we’re trying to protect you that way.”

Superintendent’s response

Interim Superintendent Steven Nilhas credited the teachers for their “ingenuity and flexibility and creativity” in dealing with the ransomware attack.

“I just want to commend them, especially for making it work, and Mika on the student side as well,” he said.

Nilhas said they would build back a system that is better and better-protected in the future.

Nilhas also noted the Wellness Committee has rescheduled its meeting to 5 p.m. on Wednesday, Dec. 20, so more members of the public will be able to attend.

“We’ve got a long road to hoe on this one,” he said of the wellness policy. “I don’t want to leave the impression that next week we’ll meet and everything will be fixed. That’s not going to happen. Next week is the starting point. We reengage our community, we engage our stakeholders, and we work together, listening and addressing their concerns that were brought forth to this body as well as other forums, and move forward in a sensible way.”