Hackers gained access to about 422 files in ransomware attack against Riverhead School District last November, superintendent says

The data breach of the Riverhead Central School District late last year resulted in an unauthorized individual gaining access to approximately 422 files/folders, according to the latest update by district superintendent Dr. Augustine Tornatore sent to parents and staff members potentially affected.

Some personal information that was potentially exposed may have included a child’s name, parent or other family member names, addresses and date of birth.

An investigation determined the individual gained access on or about Nov. 9, 2021.

“Please note that there is no evidence at this time that any of your child’s personal information has been misused as a result of this incident,” the superintendent wrote in the letter dated March 22.

An investigation continues into the incident as the district has been working with cybersecurity counsel. They’ve also notified the Department of Homeland Security and FBI’s cybersecurity unit known as IC3. Mr. Tornatore said the district is also taking steps to strengthen security to prevent a similar incident from occurring again.

In early December, the district experienced a ransomware incident, which was the first indication of the earlier data breach. The district at the time said its staff WiFi network was down and all desktop computers were turned off as the technology department supplied clean computers in “key areas.” At the time, the district did not specify whether it was a ransomware attack, where cybercriminals try to “lock” an organization’s digital files to coerce payment.

“Unfortunately, these types of incidents are becoming increasingly common, and even organizations with some of the most sophisticated IT infrastructure available are affected,” Mr. Tornatore said. “We have since worked diligently to determine exactly what happened and what information was involved as a result of this incident.”

The superintendent confirmed to the News-Review that no payment was made to the cybercriminals as part of the ransomware. 

Mr. Tornatore said the district is not aware of any fraud related to the data breach at this time. He encouraged parents to remain vigilant, to monitor their child’s accounts and immediately report any suspicious activity or misuse of their child’s personal information. The district provided parents links on how to safeguard their child’s personal information, including from the New York Office of Attorney General and the Federal Trade Commission, as well as credit bureaus such as Equifax Security Freeze, Experian Security Freeze and TransUnion Security Freeze. Mr. Tornatore also encouraged parents with questions to call (833) 749-2004, Monday-Friday between 9 a.m. and 9 p.m. That number provides a link to IDX, a consumer privacy platform.

A website was set up through IDX on behalf of Riverhead Central School District “for the purpose of providing you with valuable services and information to mitigate any risks in the event that you experience identity theft as a result of this situation.” The website, response.idx.us/riverhead, provides information on the cyberattack and a link to complimentary credit monitoring and identity theft protection services for individuals whose social security numbers and/or financial account information was potentially affected. However, it notes that no social security numbers or financial account information of any current or former Riverhead students were impacted.

The website notes that the district maintains personal information of current and former students and staff members, so the data breach could have extended beyond current students and some graduates received letters warning of the breach.

“Please know that the protection of your child’s personal information is a top priority, and we sincerely apologize for any concern or inconvenience that this matter may cause you,” Mr. Tornatore said.