Haywood County Schools Ransomware Attack

Haywood County -- Haywood County Schools reported a ransomeware attack on Augutst 25, 2020 and have given daily updates. Yesterday, schools were given Optional Workdays Thursday and Friday. The original ransomeware attack announcement and updates can be read below:

Aug 25, 2020

We deeply appreciate the support we have received from multiple agencies and organizations.  Our IT Department reacted quickly yesterday morning. Individuals were deployed from Microelectronic Center of North Carolina (MCNC) and the NCLGISA Strike Team. NCLGISA is an association of the North Carolina local government information technology professionals. Both groups have extensive experience in addressing ransomware attacks. The deployed support members worked into the evening with members of our IT staff. This morning the National Guard
arrived onsite. The National Guard will focus on forensic work.

At 10:00 a.m. this morning, we participated in another multiagency meeting. In a short amount of time, we have learned a lot.

Our financial and payroll information was not impacted. We anticipate being able to pay

our employees on time. Please bear with us if there are glitches. Members of the Finance
Department are working from a remote location because our normal Internet and server
support is missing. With that said, we expect the end-of-month payroll to occur as
scheduled. We will not be able to put paystubs on the employee portal at this time.
Our third-party data storage was not impacted. PowerSchool (student data), Orbit, Google
email, other Google applications, Remind, and any other third-party data is secure.
Chromebooks were not individually impacted. However, Chromebooks cannot be used at
this time because they automatically connect to the network and the network is down.
Staff computers are not safe to use at this time.
Personal computers (not associated with Haywood County Schools) were not impacted.
Google email can be used from a personal device.
Our Next steps:

We will work to bring on-site communication tools online beginning with telephones.
Reconnect student devices to the network for instructional purposes.
Continue assessing staff computer status and remedy as appropriate.
Data regarding the ransomware attack will be shared with the FBI.
Our delay in restarting remote instruction is the uncertainty about the use of staff computers. We will know more when the forensic work is complete.

We apologize for being unable to communicate as effectively as normal. Servers, Internet, and telephone services are still down in the school system. We will send another update at the end of the day.

Contact: Dr. Bill Nolte, Superintendent

#####

Haywood County Schools – Second Update – August 25 Update
By admin / August 25, 2020

 
Haywood County Schools will be closed for instruction on Wednesday, August 26, 2020 due to a Ransomware attack. It is a Workday. The first half of the day is mandatory and the second half of the day is optional. The mandatory morning session is needed for teachers and other staff to assist with screening for corrupt computers.

The school system is providing principals with directions for teachers and other staff members to check their school issued devices to determine if they were impacted by the ransomware attack.  Teachers, we need your on-site assistance with this process to expedite our return to remote learning. Please plan to help us with this process unless you were previously given an exemption to work remotely.

This afternoon we restored telephone service to the Central Office. We are in the process of restoring telephone service at the schools and other school system facilities beginning with the high schools. While the forensic work is still ongoing, we are cautiously optimistic regarding the scope and nature of the ransomware attack.

Again, we thank our IT Department for reacting quickly yesterday morning. The assistance from deployed members of the Microelectronic Center of North Carolina (MCNC), NCLGISA Strike Team and National Guard has been nothing short of outstanding. We cannot thank you enough for your assistance.

We have another 10:00 a.m. multiagency meeting planned for Wednesday. In an effort to keep everyone in-the-loop, we are resharing the following information

Our financial and payroll information was not impacted. We anticipate being able to pay our employees on time. Please bear with us if there are glitches. Members of the Finance Department are working from a remote location because our normal Internet and server support is missing. With that said, we expect the end-of-month payroll to occur as scheduled. We will not be able to put paystubs on the employee portal at this time.
Our third-party data storage was not impacted. PowerSchool (student data), Orbit, Google email, other Google applications, Remind, and any other third-party data is secure.
Chromebooks were not individually impacted. However, Chromebooks cannot be used at this time because they automatically connect to the network and the network is down.
Staff computers are not safe to use at this time.
Personal computers (not associated with Haywood County Schools) were not impacted.
Google email can be used from a personal device.
Our Next steps:

We are bringing on-site communication tools online beginning with telephones.
We are working to reconnect student devices to the network for instructional purposes.
We are working to determine the status of staff computers and remedy as appropriate.
We are sharing appropriate information with the FBI.
Our delay in restarting remote instruction is the uncertainty about the use of staff computers. We will know more when the forensic work is complete and teachers help use with screening tomorrow.

Thank you for bearing with us we work to restore communication and other school system services.

Contact: Dr. Bill Nolte, Superintendent

 
 ########

August 26th Ransomware Update for Staff and Community
By admin / August 26, 2020

 
HCS staff and community, the recent ransomware attack is requiring us to rebuild our entire network and related technology services. We are confident that we will have some Internet restored tomorrow. However, it is unlikely it will be viable at all locations until sometime next week. For that reason, schools will be closed for instruction for the remainder of the week. Thursday and Friday will be Optional Workdays.

We are using extreme caution because we want to avoid any setbacks when we restart instruction and reopen our technology resources. We will continue providing periodic updates. Later this afternoon, we will send a similar email message to all staff and send a press release to the media.

Thank you for all that you do for our students, staff, and the community.

Contact: Dr. Bill Nolte, Superintendent