> JapanHacked_
[Contained][Severity: Critical][Ransomware]

Minamiboso City: the school affairs network of its elementary and junior high schools was infected with ransomware, and it cut the network and school work stopped

Ransomware was found on July 17. It was a LockBit 3.0 attack that came in through the SSL-VPN device. A leak is considered unlikely.

Disclosed

2022-07-19

Organizations involved

1

Leaked or at risk

Unknown

Downtime

Unknown

What happened

  1. At 3:30 a.m. the contractor noticed that the server was unreachable, and ransomware was found. The network was cut and the police were consulted. [1]

  2. The city announced the case. [1]

  3. A second report gave the investigation results. The attack was by LockBit 3.0 and the attacker had entered with the administrator account of the SSL-VPN device. The school affairs network is usable again but is not connected to the internet. [2]

Impact

The server held staff personnel information and pupils' addresses, names, guardians' contacts, grades and attendance. No specific leak has been confirmed. [1]

The entry route was an unauthorized login to the SSL-VPN device. The remaining logs could not show how the attacker learned the administrator account's ID and password. From the firewall logs the city considers it unlikely that staff personnel information or pupils' personal data was taken out. No publication on the dark web has been confirmed. Restoring the encrypted information is difficult, and the SSL-VPN device that was the entry point will not be used. [2]

Timeline

  1. Detected 2022-07-17
  2. Disclosed 2022-07-19
  3. 2 days

Attack or cause

Method
[Ransomware]
Impact
[Service outage]
Entry point
VPN device

Data exposed or at risk

[Name][Postal address][Phone number][Education][Employment]

Organizations involved

Open in organization search

Sources

  1. [1][Official]市内小中学校の校務ネットワークに対する不正アクセスについて | 南房総市ホームページMinamiboso City · 2022-07-19
  2. [2][Official]市内小中学校の校務ネットワークに対する不正アクセスについて （第2報） | 南房総市ホームページMinamiboso City · 2022-09-21