Hacking forces a delay at Connecticut schools

All summer long, educators and officials in Hartford, Conn., readied the city’s schools to reopen amid a pandemic. They rearranged classrooms, adjusted schedules, and distributed electronic devices as they prepared to welcome some students back to buildings that had been dormant for months.

But on Tuesday, the scheduled first day of the school year, the district found itself paralyzed by a virus entirely different than the one they had been expecting: a ransomware attack that forced Hartford to postpone opening its public schools.

Like many districts across the country, the city had adopted a hybrid model for reopening, in which some students would return to school buildings while others would remain in a virtual setting.

After city employees spent Tuesday restoring systems that were compromised in the attack, Hartford’s public schools were expected to open Wednesday, Superintendent Leslie Torres-Rodriguez said.

Though Hartford officials still were investigating the attack and assessing its impact, they said they didn’t believe that any personal or financial information had been stolen, Mayor Luke Bronin said at a news conference.

But the cyberattack left the 18,000 students enrolled in Hartford’s school district, one of Connecticut’s largest, in limbo at a time of nationwide uncertainty over pandemic-era education.

“We had a very unusual summer with everything we had to do to get ready to go back,” said John Fergus, a spokesman for Hartford schools. “So this is not something I thought we’d be dealing with on the first day.”

Ransomware attacks, in which hackers shut down entire computer networks and demand payments to restore access, have been a growing problem for municipalities and businesses across the United States in recent years.

After several locales in Connecticut fell victim to the crime last year — including the school district in Wolcott, Conn., that was hit twice in four months — the statewide school boards association urged districts to boost their cybersecurity protections.

Hartford, where the school district shares technology resources with the city government, spent about $500,000 upgrading its security system last year, Bronin said Tuesday. He added he believed that investment helped the city successfully respond to this attack.

Hartford officials first learned of the ransomware attack Saturday, when they discovered that more than 200 of the city’s servers, including some used by the school system, the police department and 911 dispatchers, had been compromised.

Bronin said that while Hartford, the state’s capital and its fourth most-populous city, had been the target of hacking attempts in the past, the ransomware attack was “the most extensive and significant” of recent years.

The city was able to quickly shut down servers and freeze its technology systems, Bronin said. The city’s police, fire and 911 systems continued to run smoothly, and authorities said they didn’t believe any sensitive data had been stolen. Hartford didn’t have to pay a ransom to regain access to its servers.

But over the weekend, many of the servers and technology systems needed to be restored and rebooted, a process that took a considerable amount of time and was still ongoing as of Tuesday morning, Bronin said.

Among the impacted systems were the school district’s student information system, which has personal data, academic records and schedules, and a transportation system that provides realtime information about school bus routes.

Torres-Rodriguez said the student information system had been fully restored by midnight Monday, after a seven-hour rebooting process. But the transportation system hadn’t been fully repaired.

Though most of Hartford’s students had opted for remote education, a significant number still were planning to attend in-person classes Tuesday. Concerned that those students wouldn’t have safe transportation, TorresRodriguez decided to cancel school.

“If we know that we have nearly 4,000 students that are expecting to come to school, relying on bus transportation, than we have to make sure that we make that available,” Torres-Rodriguez said.

Besides restoring the school district’s information systems, city employees were also going “school to school, desktop to desktop” to make sure that teachers’ equipment was not affected and could be safely used for inperson and remote instruction, Bronin said.

Bronin also said officials weren’t sure who was behind the attack or whether it was intended to target the first day of school. Hartford Police Chief Jason Thody said officers were investigating and had sought assistance from the FBI.