Schoolrush.com listed on Killsec ransomware leak site

• Ransomware group: Killsec
• Country: United States
• Sector: Technology
• Announcement date: August 22, 2024

Killsec claims data breach at schoolrush.com

The ransomware group known as Killsec has published an announcement on their leak site claiming to have compromised the platform schoolrush.com. The group listed the organization on August 22, 2024, asserting that they have successfully exfiltrated data belonging to the platform. This announcement follows a pattern common in modern cyberattacks where threat actors use public leak sites to pressure victims into paying ransoms.

According to the claims made by the group, the incident involves a significant breach of the platform's database. Killsec has stated that they are demanding a ransom of 10,000 USD to prevent the further exposure of the stolen information. To support their claims, the group has provided samples that they allege were taken directly from the organization's database. These samples serve as a method of proof to demonstrate the validity of the breach to the victim and the public.

Details of the alleged data theft

The announcement made by Killsec claims to include a full database dump. The group asserts that the stolen information contains sensitive student data and comprehensive lists of parents. Based on the samples provided in the leak, the data allegedly includes a variety of personally identifiable information (PII) that could be used for malicious purposes. The specific types of information mentioned in the samples include:

• Names and surnames
• Email addresses
• Home phone numbers
• Cell phone numbers
• Relationship details
• Student SIS ID numbers

The presence of such specific identifiers, particularly student SIS ID numbers and contact details for both students and parents, highlights the sensitive nature of the information involved in this alleged breach.

About schoolrush.com

School Rush is a specialized platform designed to facilitate communication between schools and parents. The service provides several key functionalities to bridge the gap between educational institutions and families. It enables schools to publish personalized event calendars, allowing for better organization of school activities. Additionally, the platform allows for the instant transmission of classroom photos and activities, helping parents stay connected to their children's daily school life. Furthermore, the platform provides tools to manage staff and student directories, serving as a central hub for school administration and communication.

Implications and industry risks

This incident suggests that user data from an educational technology platform may be at risk. The allegedly leaked data could potentially lead to identity theft or targeted phishing attacks against students and parents. Because the organization is based in the United States, this incident may have implications under state-level data protection laws and regulations governing the privacy of educational records.

The use of the double extortion method is a notable aspect of this incident. In double extortion, threat actors do not just encrypt an organization's data to disrupt operations; they also steal the data and threaten to release it publicly. This increases the pressure on the organization, as the threat of public exposure can cause significant reputational damage and legal consequences, regardless of whether the organization can restore its systems from backups.

While information about the Killsec group remains limited, their use of ransomware tactics poses a clear risk to an organization's operational continuity and reputation. For organizations operating in the educational technology sector, such incidents underscore the importance of robust security measures. Common defensive steps for organizations facing these threats include implementing strict access controls, maintaining regular offline backups, and employing continuous monitoring to detect unauthorized data exfiltration. Protecting the privacy of student and parent information is critical for maintaining trust within the educational community.