Schools website provider FinalSite hit by ransomware

Online services at thousands of schools worldwide affected

FinalSite, a SaaS-based marketing and communications platform focused on the education sector, has been hit by a ransomware attack, leading to loss of many online services in thousands of schools and colleges around the world.

Problems with the systems were spotted by educational establishments on Tuesday 4^th January, when a number of schools and colleges reported that their websites were throwing errors, only loading partially, or had become completely unreachable.

Initially, FinalSite's status page said that it was suffering "increased error rates and performance issues and performance issues", without specifying a cause.

However, on Thursday 6^th January, the company acknowledged that it had been hit by ransomware.

"On Tuesday, January 4, our team identified the presence of ransomware on certain systems in our environment. We immediately took steps to secure our systems and to contain the activity. We quickly launched an investigation into the event with the assistance of third-party forensic specialists, and began proactively taking certain systems offline."

In its latest update, FinalSite says the "vast majority of front-facing websites are online", although "Some sites may still lack proper styling, admin log-in functionality, calendar events, or constituent directories."

``

The company asserts that it has "full access to our files and data", adding that there is no evidence that FinalSite or client data has been stolen. A forensic investigation is ongoing, it said.

So far, no cyber actor has taken responsibility for the ransomware attack.

Educational institutions and their suppliers have become popular targets for ransomware gangs recently, as the pandemic has forced schools and colleges to switch to remote learning. Educational systems are vulnerable to such attacks, and their effects are immediately felt by a large number of people, a fact used by gangs to extract payment quickly.

As a result of increased attacks, many schools and colleges have lost their coursework, financial records and Covid-19 testing data.

Danny Lopez, CEO of Glasswall, said: "News like this regarding FinalSite is concerning considering the extensive damage that can be caused in terms of lost data - for both students and staff - and access to vital educational services. The SaaS provider works with over 125 British independent schools, meaning that an attack that causes downtime and potentially loses data has far-reaching implications."