EASTHAMPTON — A forensic review found that no student or faculty data was stolen from Easthampton Public Schools in what the district described as a cybersecurity incident last month.
“We have no evidence that data was subtracted from our system for either student or teacher data,” Superintendent Michelle Balch told the Gazette Tuesday.
Balch notified district families of the news Monday after meeting with the company that conducted the forensic review, Surefire Cyber, on Friday. The company conducted a monthlong analysis of the district’s information after suspicious activity was flagged by the Information Technology department Oct. 5.
Balch met Friday with Surefire Cyber, the company that conducted the review, and notified district families Monday. The company spent a month analyzing the district’s information after the information technology department flagged suspicious activity on Oct. 5.
“We worked with them to give them access to all the data in our systems,” Balch said. “They went through all of it to identify if files were subtracted.”
At the time, Balch said, the IT department noticed random files popping up on multiple individuals’ desktops that no one in the district had created.
“We saw it on a couple of devices,” Balch said. “Based on that, we thought it did not look right and to prevent any other things from happening we basically pulled the plug on all of our servers.”
Schools never closed, but students, teachers and administrators had to operate with no internet and could not access their online systems such as PowerSchool for multiple days, going “back to paper and pencil,” Balch said.
There is no evidence that the incident was related to a cyberattack on Springfield Public Schools around Labor Day, Balch said. In that attack, an unauthorized group gained access to the Springfield district’s computer network, forcing officials to shut down key systems and close schools for four days.
Springfield had set up hot spots to maintain internet connection. Balch said the Springfield district allowed Easthampton to use the hot spots while its servers were down. Balch said the quick action from the IT department was likely a crucial measure to prevent data from being taken.
“It’s a balance when deciding to take our systems offline,” Balch said. “We did it and I think that helped mitigate our exposure.”
Balch said the forensic review by Surefire Cyber cost the district $10,000, the deductible charged for coverage of cybersecurity incidents by Easthampton’s insurance provider, the Massachusetts Interlocal Insurance Association, a nonprofit that provides insurance to more than 400 municipalities and public entities. Without insurance, she said, the cost likely would have topped $100,000.
The school district was able to further minimize costs by restarting its servers with the city’s new cybersecurity infrastructure. The city installed new servers at the Water Department over the summer with a $191,000 state Community Compact Municipal Fiber Grant.
“We are very lucky that the city had those two servers and that the mayor authorized us to take over those servers,” Balch said.
Balch said she has been in communication with several other towns that have experienced cybersecurity incidents in the recent past, including Sutton in Worcester County.
Moving forward, Balch said the incident has reinforced the need for cybersecurity measures such as multifactor authentication, which the district will expand in the near future. The district has also expanded antivirus software as a result of the incident.
“I think it is something that all districts need to be prepared for and we were so fortunate to have cyber insurance to cover the cost of this because recovery costs would have been significant,” Balch said.
