The prestigious Howard University, known for being a historically Black college and university, has become the newest high-profile U.S organization that has fallen victim to a ransomware attack.
According to a statement released by the University, “On September 3, the Howard University information technology team detected unusual activity on the University’s network. In accordance with our cyber response protocol, and to mitigate potential criminal activity, Enterprise Technology Services (ETS) intentionally shut down the University’s network to investigate the situation.”
Further investigation by the ETS and its partners revealed that the University had experienced a ransomware attack. Until now, there has not been any evidence that personal data of over 9,500 undergraduate and graduate students was accessed or exfiltrated in the incident, but the University stated that its investigation is underway, and is actively working with external forensics experts and law enforcement agencies.
Following the incident, the University canceled all online and hybrid classes for undergraduate students. And at present, only in-person classes will be resuming.
The nation has seen an uptick in ransomware attacks from the onset of the COVID-19 pandemic. With classrooms taking the digital route, attacks against educational institutions witnessed a sudden surge.
The Biden administration had recently signed a memorandum on “Improving Cybersecurity for Critical Infrastructure Control Systems,” where it promoted “implementing specific mitigation measures to protect against ransomware attacks and other known threats to information technology and operational technology systems within prescribed timeframes.”
Added to that, several federal bodies, including the Department of Justice, the FBI, Department of Homeland Security’s CISA division, and the Secret Service, have all urged Congress to pass a bill that would force companies to disclose ransomware attacks. According to the agencies and even the Senate Judiciary Committee, several small organizations do not disclose ransomware attacks. This is often due to fear of regulatory action, reputational harm, or sometimes hindrance in business operations.
