11 ms·
Illinois college, hit by ransomware attack, to shut down
- pm90 4y agowould be so easy for some random billionaire to cut them a check
- blagie 4y agoIt wouldn't be easy. It seems like they were providing a sub-par education at >$30k per year. https://lincolncollege.edu/file/471/21-22%20Undergraduate%20Catalog%20-%20Final.pdf https://lincolncollege.edu/file/471/21-22%20Undergraduate%20... Math runs out at calculus. No computer science. Very few programs which would translate to real careers. Reforming a school like this is much more than cutting a check. It's a worthwhile project, but it's a major undertaking.
- UnpossibleJim 4y agoWould be so easy for the US government to turn community colleges into 4 year colleges and make them part of them part of the basic curriculum, should students want to continue their education for free, while allowing private universities to remain just like private primary schools. Our population shouldn't have to rely on the whims of billionaires while our government wastes billions on no-bid contracts, ridiculous military spending and domestic spying programs... I apologize for my rant =)
- pm90 4y agoNo that totally makes sense. It would be a small fraction of the defense budget. And having an educated and informed populace is just what we need to remain competitive globally.
- chadash 4y agoI am sympathetic to companies that keep backups of their data, but don't have comprehensive plans to restore that data after an attack. A company that plans properly might be up-and-running within a day or two, but getting to that point isn't easy. But getting to the point of needing to shut down entirely because of a ransomware attack seems like negligence. If your data is that vital to you, you really ought to have some backup of it.
- spankalee 4y agoThey got back up and running, but don't have enough enrollment to keep the doors open. The ransomware attack is just part of the reason - in addition to COVID - but it might have been a major factor in them not getting enrollment to the point where they could survive.
- taraskuzyk 4y agoOne hell of a way to avoid your CS exam.
- vmception 4y agoA tragedy That needs to happen The humanizing done about how its was something like an HBCU and weathered other calamities is sad, should also be a wakeup call to other organizations
- rediguanayum 4y agoI don't know why this was down voted, but I agree, that this tragic shutdown makes it clear that Ransomeware affects the real world.
- Buttons840 4y agoNations should lessen the penalties for white-hat and even grey-hat hackers who report their findings. They should have strong protections; they are helping all of society and national security. Instead, we have politicians and executives who make legal threats to cover their mistakes and everyone suffers for it. I have this view because I have personally walked away from security problems I've discovered simply by pressing F12, I don't want the legal hastles and costs. Sadly, I think we're more likely to see pressing F12 become illegal, meanwhile society will lament that half the country's personal data is leaked on a weekly basis and ransomware runs rampant.
- munificent 4y ago> Nations should lessen the penalties for white-hat and even grey-hat hackers who report their findings. Digital Good Samaritan laws.
- hinkley 4y agoThere's an overlap between privacy, civil liberties, and anti-discrimination concerns where laws that can be selectively enforced get disproportionately applied to any and all groups that have 'isms' attacking them. I confess that while I used to spend quite a deal of time thinking about this class of problem, I haven't done much of it recently, so the following is a mix of potentially outdated thoughts and speculative nonfiction. If you have the privilege to be outside of any or all of those groups, I feel like it falls on us to speak up to ensure that other people are okay, and Good Samaritan laws can be problematic in this respect, because it's too easy to convince a jury to deny 'those people' standing. I wondered in another response if some sort of self-reporting system would better serve this space. Possibly 'feature-parity' with other citizen-action laws where community policing and reporting are carried out. The latter closes out a learning opportunity however because you're identifying and reporting a suspicion of an issue and allowing The Authorities to look into it. "We will take it from here." doesn't afford you the opportunity to become part of 'we'. Perhaps there's precedent with confidential informant laws, and we need to reframe white hat hackers under that umbrella.
- FrenchDevRemote 4y ago
- duped 4y agoIt sounds like they weren't in a great financial situation to begin with. Definitely a tragedy to have everything down for three months and to find out afterwards that you're not going to have enough money to stick around next year. I wonder what the ransom was and if they paid it. Side note: Planet Money had an interesting segment on insurance claims for things like cyber attacks last week, it's worth giving a listen.
- toomuchtodo 4y agoCyber insurance premiums are skyrocketing YoY due to ransomware attacks based on conversations with clients. Overall, it’s still a challenge to demonstrate the value of defending against them (reducing attack surface, real backups and data recovery plans, phishing exercises to see who is click happy and what their privileges have access to, etc) to folks who don’t understand the risk this poses. Like driving without insurance, it works until it doesn’t.
- duped 4y agoThe point they made was some insurance companies consider state sponsored cyber attacks as "acts of war" under their terms and not covered in their policies. It was part of a larger segment on how insurers do or don't insure catastrophic events, like pandemics or war.
- jabroni_salad 4y agoCyber providers are becoming much more savvy and are starting to decide that self-service 'yeah we are totally doing this' self-assessment checklists aren't sufficient. I have around 20 financial institutions on my client list and 11 of them have had their first hands-on penetration test in the past year. A year ago they would just send a laptop with Nessus on it and then sign off on a risk sheet full of the usual llmnr/nebios/kerberoast/smb1 vulns because they didn't know what it meant. Now they will pop your domain administrator and refuse your renewal or jack your rates until you get a followup pentest demonstrating that those vulns have been resolved.
- 4y ago
- zamadatix 4y agoThe posting on the colleges website paints a much bleaker picture. The ransomware attack certainly didn't help but the school was already near shutting down due to huge drops in enrollment from covid and expenses related to implementing remote learning. It's not like they were just doing fine and didn't think to spend money on IT resulting in an untimely demise they were on the way out and also happened to get hit by ransomware during that. I wouldn't be surprised if they weren't doing particularly well prior to either of those issues even. I wouldn't be surprised if there were multiple other things they should have been doing to lower operational risk but couldn't realistically do given their situation.
- solveit 4y agoOf course. If the college was otherwise doing well, they would be able to get a loan to smooth over a rough patch.
- daniel-cussen 4y agoDon't assume loans are that simple. Everyone assumes they're that simple. They're deadly, it's the compound interest, the intrinsically runaway loan, the situation Hell is based on. It leads to gambling and prostitution for example. All sins.
- feoren 4y ago> It leads to gambling and prostitution for example. That took a wild turn. Does allowing ice fishing on Lake Michigan also lead to prostitution?
- daniel-cussen 4y agoDoes ice fishing as you describe involve debt?
- TapWaterBandit 4y agoI borrowed $10 from a friend for lunch once and within a year I was having to give out handjobs by the waterfront just to pay off the interest.
- Wowfunhappy 4y agoHow did we end up at a point where we are this reliant on the internet? Any truly critical system should not be connected to the public internet. Computers with internet connections are for sending email and reading Wikipedia. Any data critical to your organization should be accessed from separate terminals connected via LAN. No VPN, that's still the internet. Do that, and unless you're the CIA you will never be hacked. You can even run Windows XP if you feel like it. The internet is the root of the problem, and it's time we start realizing that some things shouldn't be online.
- jacobr1 4y agoThe problem is that much (not all) the business important data is involved the public internet. Take this school for example - prospective students applied online. One could imagine sneaker-netting the application data to an airgapped network, but that introduces its own costs and risks. Email (or other messages systems like slack) are one of primary tools of business, facilitating communication within an organization. You can't do that well with an air-gapped network, except to make that network really leaky.
- Wowfunhappy 4y agoI totally get it, but the internet hasn't been around that long. How did we handle this 30 years ago? I imagine students applied via snail mail, and then someone manually entered the information into a database. There's no reason to go back to paper applications, and that database should absolutely be digital—but I think we could do a lot more manual entry.
- MandieD 4y ago25 years ago: carefully hand-write half-page essays on pre-printed application forms, attach $50 checks for application fees, beg your mother to drive your procrastinating self to the downtown post office by 5pm on December 31. Start receiving long-awaited envelopes around Spring Break, and speculate on whether said envelopes were thin because they contained simple rejection letters, or because the desired financial aid details would follow the next week.
- Loughla 4y agoHey, I actually have experience with that school! I did some consulting with them about a decade ago. The ransomware attack certainly didn't help, but it is wildly misleading to say, or even imply that caused them to shut down. The actual reasons: (a) They filled a niche that didn't need to be filled anymore. They used to absorb students from other local universities (ISU, UIS, UIUC). Those schools have realized the value of helping their own students be successful, leading to declining enrollment. (b) They were previously a community college, and began awarding bachelor's degrees. They were then fighting in a weight class way above what they were used to, and never really got their feet under them (to use some mixed metaphors). (c) They were expensive for the quality. They gave a good education, but had zero connections to business and industry to justify the cost. (d) They had a pipeline from Chicago's south and south-east side that has recently been sniped by large state schools, leading to a decline in enrollment. For context, I worked with them on enrollment management and declining enrollment a decade ago.
- haggy102 4y agoGreatly appreciate the context. Closures like this are rarely (if ever) as one dimensional as the public announcements make them appear to be.
- tmp_anon_22 4y ago> enrollment management What would be a comparable industry perspective to the way colleges fight over tuition generators (students)? Oil companies fighting over oil fields?
- nope96 4y ago"Fortunately, no personal identifying information was exposed." How can they know this?
- hakre 4y ago> How can they know this? No insights on that, but this is more the way I read such statements: This is their report of what they know. Common sense dictates that this does not mean much as we normally only know a fraction of what is. However it might also be a sign that they are not yet aware of much at all as it is that overly unspecific.
- edgyquant 4y agoMaybe the database that was stolen had none? I know my old community college just used a pin for everything. Maybe all the data tracks to this pin and then another database contains the pin to real name/info mapping? Hopefully personal information at a college has stricter regulation.
- hakre 4y agoIn this case the pin is the person identifying date. If such a database system was used at place and in time of the incident, it is known how many individuals are affected and what data got out. It is just not known which individuals in specific. Should be common to send a notice to all individuals then and explain the details so those who are affected do know and can act.
- protomyth 4y agoThey might have outsourced their enrollment system like a lot of smaller colleges to the vendor (e.g. Empower, Jasmine) and not have had the information on servers that were compromised.
- GreedCtrl 4y agoThe college in question is Lincoln College. This is somewhat confusing because there is a college called Illinois College. Because of this news, they are accepting transfers from Lincoln for all students in good academic standing: https://www.ic.edu/news/04-4-2022/illinois-college-extends-benefits-lincoln-college-transfer-students https://www.ic.edu/news/04-4-2022/illinois-college-extends-b...
- hsnewman 4y agoThe headline is clickbate. According to the article it says it closed due to COVID and the attack.
- hunter2_ 4y agoYes, but at the same time, an experienced consumer of headlines should parse this syntax as "Illinois college to shut down. Illinois college hit by ransomeware attack, as well." (i.e., despite weaving the two things together, causation isn't actually claimed). I don't like it, but it's been the nature of the headline game since long before clicks.
- aphexairlines 4y agoWhoever sold the vulnerable software should be liable for damages.
- pc86 4y agoHow about whoever wrote it?
- bachmeier 4y ago“Lincoln College was a victim of a cyberattack in December 2021 that thwarted admissions activities and hindered access to all institutional data, creating an unclear picture of Fall 2022 enrollment projections,” the school wrote in its announcement. “All systems required for recruitment, retention, and fundraising efforts were inoperable." How is this possible? There's literally not a second copy of the data anywhere? The people working in the admissions office didn't have a printout and they had absolutely no idea what the numbers looked like? It's one thing to have all the videos for online classes get locked up in a ransomware attack, but this simply cannot be true.
- protomyth 4y agoWe were looking at "cyber insurance" for our college and found out that we would be disqualified because every network connected device (even those on isolated networks) needs to have 2FA. Well, we have a network connected CNC machine at it has no provision for it. Another institution has the same machine and was denied. They tried every a lot of gyrations but got nowhere. Even a previous security audit would not help. I get the feeling this is one of those rules setup to make sure they don't deal with small institutions with small IT departments or they really don't know how much the cost of insurance to them will be.
- gowld 4y agoThat rule would apply to larger IT depts too, though, right?
- protomyth 4y agoI would imagine they are in a better position to negotiate and have the resources to make strict rules the insurance company would like.
- Ansil849 4y ago> We were looking at "cyber insurance" for our college and found out that we would be disqualified because every network connected device (even those on isolated networks) needs to have 2FA. Well, we have a network connected CNC machine at it has no provision for it. How enforceable is this? Why could you not just leave that machine out of your inventory?
- protomyth 4y agoWell, if something goes wrong and we do an insurance claim, they would take a look and not pay our claim. I am not quite good enough to hide the CNC machine. Ask any homeowner how good these folks are at avoiding paying claims.
- pledess 4y agoMy thoughts immediately went to a hypothetical ethical question. Suppose that a ransomware threat actor saw the NBC story, felt bad that this happened to Lincoln, and offered to make (anonymously) the "transformational donation" mentioned in the story, while making clear that the source of funds was ransom received from other victims. Should Lincoln accept the money? (In other words, there's a yin and yang situation in which the ransomware threat actor happens to have a philanthropic arm.)
- Invictus0 4y agoRephrased more generally, is it ethical to accept donations arising from criminal enterprises? I think most people would say that the answer is no. This topic has been widely discussed on HN with regards to the MIT Media lab accepting money from Epstein.
- pledess 4y agoAgreed! It demonstrates how dramatically the answer changes depending on exactly how you ask the question. Suppose Lincoln could get $50 million (with those funds ultimately sourced from a criminal enterprise) in each of four different scenarios. I asked 8 people locally and here's how many would take the money. (A) The government tracks down the ransomware guy, seizes his assets, and decides that $50 million is Lincoln's fair share to reimburse Lincoln's losses (8 of 8 would take the money). (B) Lincoln tracks down the ransomware guy, takes him to court, and wins a civil judgment of $50 million (8 of 8 would take the money). (C) Lincoln tracks down the ransomware guy, their lawyers show proof of Lincoln's losses and how much they could potentially win in a civil trial, and the parties agree to a $50 million out-of-court settlement (7 of 8 would take the money). (D) A ransomware criminal proactively contacts Lincoln, the criminal won't comment on whether he had any role in harming Lincoln (and Lincoln doesn't know either), but the criminal offers to donate $50 million to Lincoln anyway (2 of 8 would take the money).
- amelius 4y agoAnother attack made possible by cryptocurrencies.
- 10amxn10 4y ago
- Melting_Harps 4y ago> The ransomware attack certainly didn't help, but it is wildly misleading to say, or even imply that caused them to shut down. I wrote a Blackmirror fanart script based on Hackers using Ransomware to threaten Universities to write down student debt, I got to Act II before I left it. I want to spend more time writing this year, but so far I have spent way too much time on HN than creative writing and that is unfortunate. > For context, I worked with them on enrollment management and declining enrollment a decade ago. What measures did they take? And what expertise cold you lend them to counter this?