FBI and CIA investigate Pueblo County School District data breach

(PUEBLO, Colo.) — Personal information of current employees and former Pueblo County School District 70 (D70) students may have been compromised by a recent data breach.

The district discovered the breach on May 17, and believes it may have begun on April 27. D70 said this potentially affected student and staff records from 1991-2006. The district says it is working with cyber security experts to find out the scope of the breach.

“It’s kind of like the same reason why we probably all have some files on our computers that we probably need to go through periodically and delete and we didn’t. We have taken measures at this point to get rid of data and information,” says Ronda Rein, Superintendent of D70.

Rein said the district has now implemented new security measures, such as two-step authentications and removed all critical information from local servers and relocated them to more secure cloud-based servers.

On Tuesday, D70 released information on the breach, noting it was a ransomware incident from an older server, impacting former students who were in the district between 1991 and 2006, including some current staff members.

“Whenever you think about personal information, you think about your name, your phone number, your date of birth, information concerning things that associate you with who you are,” added Rein.

D70 said it did not immediately notify the public about the cyberattack because it is being investigated by the CIA and FBI, meaning the attack came from somewhere outside of the United States.

“I spoke about it to several of our staff members. It’s not something that I’ve been hiding. I’ve said that we had a cyberattack, I didn’t put out anything until I was told by the CIA and by our attorney that we could put something out,” said Rein.

FOX21’s Chief Engineer, Douglas Ducote, said organizations like school districts are often targets.

“A school district is one of many organizations that’s going to have information that is valuable. For any attack, and any kind of hacker, they’re looking for information that they can use in some other way to get money,” he said.

Ducote also explains what a ransomware attack is.

“If the bad actor is able to successfully encrypt this information, the only option that is available to the school is either to pay the ransom or walk away from all this data forever, and they just won’t do that. So, that’s why schools in particular may be targeted,” he said.

D70 said they do not have regular phishing and other cyber-attack training programs for their staff, nor is it taught in classes. Now the district says it will consider having students and staff undergo that type of cyber training.

“Unfortunately, it, a lot of times, this is a really reactionary kind of world in security. So, this successful attack will probably lead to better training, better training initiatives, better network security within this organization and any connected organizations,” added Ducote.

D70 recommends all current and former students and faculty take precautionary measures to protect their information, by monitoring credit reports and financial statements, and consider a credit freeze or fraud alert. They also advise watching for phishing or suspicious messages.

Anyone who thinks they might be a victim of the cyberattack, or who needs help, is asked to contact the district’s IT Support Team at (719) 549-6121.

For the latest news, weather, sports, and streaming video, head to FOX21 News Colorado.