Hackers attack Belgian school and demand €50 per child from parents

They have targeted the OLV Institute of Secondary Education in Berchem, Belgium. They are making ransom demands not only from the School but also from Parents individually – €50 per child – and if they do not meet these demands, they intend to publish on the Dark Web, the data they stole from them.

The Attack happened immediately after the Christmas Holidays; the school’s servers have been encrypted using Ransomware, according to local news. The original ransom demand was €100,000 which has since been lowered to €15,000.

The Management of the School confirm they have not contacted the hackers and will not fulfill their demands. Kris Smout, General Director of the School stated that this decision was based on ethical reasoning and on the advice of the authorities.

• Since the School chose to ignore the ransom demands, some of the parents received direct emails from the hackers. The hackers, who call themselves BitLock, claim they had un-detectable access to the School’s Systems for over one year and extracted approximately 45GB of Data. Allegedly, the Data Stolen included ID Cards, Diplomas, Financial Records, as well as the Sensitive Mental Health Information of Students and Staff.

• Cyber Security Experts feel that the hackers are not associated with the true LockBit Ransomware Group, but are Imitators. VRT NWS News in Belgium reported that Parents were told by Authorities not to make payment to the hackers and not to Click on any Links within the Emails sent to them.

• The School stated that they are currently conducting an Investigation into the hacking and that the Dark Web is being closely monitored to determine whether the hackers have published the Stolen Data. To date, there has been no Evidence of either Leaked or Sold Data.

This incident represents an alarming escalation of Ransomware Tactics and the hackers are attempting to intimidate Parents by directly contacting them and threatening to Publish the Children’s Personal Data if the Demand is not Met. The fact that many Educational Institutions are extremely Vulnerable due to Limited Cyber-Security Resources raises Ethical and Legal Concerns throughout all of Europe.