FinalSite: No school data stolen in ransomware attack behind site outages

FinalSite announced today the findings of a six-day investigation into last week’s ransomware attack, stating it found no evidence schools’ data accessed or stolen by hackers.

FinalSite is a software as a service (SaaS) provider that provides website hosting, design, and content management systems to educational institutions, including K-12 school districts and universities. 

Last Tuesday, FinalSite suffered a ransomware attack that forced them to take down their IT systems, including webservers hosting customers’ websites. This led to the shut down of approximately 5,000 scool websites, 3,000 of which are for public school districts in the USA.

In a media briefing today, FinalSite said they hired privacy attorneys at Mullen Coughlin LLC and cyber forensic investigators at Charles River Associates to investigate the cyberattack.

No school data stolen

After a six-day investigation, FinalSite states that they have determined what ransomware gang performed the attack and how they gained access to their network but would not be disclosing their names due to ongoing investigations.

The report also states that FinalSite is confident that no “client data” was viewed or stolen during the ransomware attack.

“After six days of investigation, we know when the threat actor entered, how they entered, and what they looked at. We are confident in saying that no client data has been viewed, compromised or extracted,” reads the investigation report from FinalSite.

“During the remaining course of the investigation, if we determine otherwise, we’ll act swiftly to notify you and take appropriate action.”

FinalSite explained that customers who use their service do not host sensitive information, such as academic records, social security numbers, payment information, or confidential information. 

Depending on the services used, though, some sites may host demographic data, including names, email addresses, and phone numbers.

While threat actors may not have stolen customer data, the hackers likely stole corporate data belonging to FinalSite during the attack.

When ransomware gangs conduct attacks on corporate networks, they commonly reside in a network for days, if not weeks, before encrypting devices.

During this time, the threat actors steal data from the victim, which is used as leverage when demanding a ransom payment.

If data was stolen from FinalSite, the threat actors would likely publish it on a data leak site unless a ransom is paid.

So while this is good news for school districts, parents, and students, it remains to be seen if the attack exposed employee data.