The ransomware gang known as Skira yesterday claimed responsibility for a December 2024 data breach at Carruth Compliance Consulting, a company which administers retirement savings plans.
Comparitech reported that this breach led to at least three dozen school districts and colleges across the US–Carruth’s clients–reporting data breaches that compromised the personal data of more than 110,000 school employees.
Rebecca Moody, Head of Data Research at Comparitech commented:
“Attacks like this highlight how far-reaching the impact of these data breaches via ransomware can be. A breach on one provider can affect multiple educational institutions, as we saw only too well with Blackbaud in 2020. Schools and colleges may have the best cybersecurity measures in place, but they’re only as good as the third parties they use.”
“It remains to be seen just how many schools have been affected by this attack, but we’ve found over 30 that have reported breaches so far. And with sensitive data involved, such as Social Security Numbers, schools need to act fast to ensure those affected are aware as soon as possible. We’d highly recommend people take up the offer of free credit monitoring and that they also remain vigilant for any phishing emails, calls, or text, and suspicious activities on their accounts.”
Paul Bischoff, Consumer Privacy Advocate at Comparitech adds:
“Ransomware attacks on US finance companies can lock down computer systems and steal data. Companies must then either pay a ransom or face extended downtime, data loss, and putting data subjects at increased risk of fraud. Ransomware can disrupt a wide range of operations including communication, financial transactions, access to stored files, and more.”
“Comparitech researchers logged 58 confirmed ransomware attacks on US finance companies in 2024, compromising 34.6 million records. The average ransom for a finance company is $1 million.”
“In addition to confirmed attacks, Comparitech tracked 151 unconfirmed claims against US finance companies in 2024, and 43 so far in 2025. These are claims made by ransomware groups but not acknowledged by the targeted organizations.”
While this isn’t the worst attack that I have seen, I would not be shocked if this does get worse. Because these sorts of attacks have a habit of starting out being not that bad. Then they get worse as more facts come to light. So be sure to bookmark this for updates as they become available.
Related
This entry was posted on March 7, 2025 at 2:29 pm and is filed under Commentary with tags Hacked. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
At least 36 US schools involved in data breach following ransomware attack
The ransomware gang known as Skira yesterday claimed responsibility for a December 2024 data breach at Carruth Compliance Consulting, a company which administers retirement savings plans.
Comparitech reported that this breach led to at least three dozen school districts and colleges across the US–Carruth’s clients–reporting data breaches that compromised the personal data of more than 110,000 school employees.
Rebecca Moody, Head of Data Research at Comparitech commented:
“Attacks like this highlight how far-reaching the impact of these data breaches via ransomware can be. A breach on one provider can affect multiple educational institutions, as we saw only too well with Blackbaud in 2020. Schools and colleges may have the best cybersecurity measures in place, but they’re only as good as the third parties they use.”
“It remains to be seen just how many schools have been affected by this attack, but we’ve found over 30 that have reported breaches so far. And with sensitive data involved, such as Social Security Numbers, schools need to act fast to ensure those affected are aware as soon as possible. We’d highly recommend people take up the offer of free credit monitoring and that they also remain vigilant for any phishing emails, calls, or text, and suspicious activities on their accounts.”
Paul Bischoff, Consumer Privacy Advocate at Comparitech adds:
“Ransomware attacks on US finance companies can lock down computer systems and steal data. Companies must then either pay a ransom or face extended downtime, data loss, and putting data subjects at increased risk of fraud. Ransomware can disrupt a wide range of operations including communication, financial transactions, access to stored files, and more.”
“Comparitech researchers logged 58 confirmed ransomware attacks on US finance companies in 2024, compromising 34.6 million records. The average ransom for a finance company is $1 million.”
“In addition to confirmed attacks, Comparitech tracked 151 unconfirmed claims against US finance companies in 2024, and 43 so far in 2025. These are claims made by ransomware groups but not acknowledged by the targeted organizations.”
While this isn’t the worst attack that I have seen, I would not be shocked if this does get worse. Because these sorts of attacks have a habit of starting out being not that bad. Then they get worse as more facts come to light. So be sure to bookmark this for updates as they become available.
Share this:
Like this:
Related
This entry was posted on March 7, 2025 at 2:29 pm and is filed under Commentary with tags Hacked. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.