West Virginia students returning to class after days-long outage following cyberattack

Nearly 20,000 students in West Virginia were forced to miss classes on Monday due to a cyberattack that crippled their school.

Berkeley County Schools said on Friday it was experiencing an internet and phone outage on Friday and spent the weekend working through issues related to a cyberattack.

Superintendent Ronald Stephens wrote a note to students and parents saying IT operations throughout the district were limited due to the cyberattack and noted that law enforcement agencies were contacted. 

BCS NTouch: We are aware and working to restore internet & phones outages across the district. Alternate phone numbers for our schools are located at https://t.co/M1lpc9Vdyh pic.twitter.com/GvDNRtUdmJ

— Berkeley Co. Schools (@BerkCoSchoolsWV) February 3, 2023

Over the weekend, Stephens published multiple messages warning students that classes on Monday may be canceled and that data held by the school may have been accessed during the attack.

“We do not know if any personal data has been breached at this time. When the investigation is complete, we will notify individuals in accordance with applicable law and provide resources to help protect against the possible misuse of their information if applicable,” Stephens said. 

“Reminder, our investigation into the scope of the data that may have been impacted is ongoing.”

By Sunday, Stephens confirmed that classes were canceled and all school activities would be postponed.

Classes will resume on Tuesday but the district is still working to restore operation systems and investigate the cyberattack, according to a statement from Berkeley County Schools on Monday afternoon.

Berkeley County Schools is West Virginia’s second-largest school district and the county – which is about two hours away from Washington DC – has a population of about 120,000.

The school did not respond to requests for comment about whether they were suffering from a ransomware attack. 

Parents expressed concerns to MetroNews because the school carries troves of sensitive information related to child protective orders and other data about emergency contacts.

The school said student devices were not affected by the attack but explained that a Board of Education meeting scheduled for Monday would no longer be streamed due to the technology outages.

Berkeley County Schools becomes the latest district to face a cyberattack in 2023. Last week, schools in Tucson, Arizona, and Nantucket, Massachusetts dealt with a range of issues related to cyberattacks and ransomware incidents.

Des Moines Public Schools in Iowa also had to cancel classes two weeks ago due to a ransomware attack.

CISA said the number of K-12 cyber incidents reported between 2018 and 2021 rose each year, from 400 to more than 1,300. Emsisoft ransomware expert Brett Callow explained that 45 districts with 1,981 schools were impacted by ransomware in 2022. 

The attack on Berkeley County Schools is the sixth reported incident in 2023.