Cybercriminals Aim BEC Attacks at Education Industry

K-12 schools and colleges are more than twice as likely to get hit with a business email compromise (BEC) than companies outside of the education industry, new research has found.

According to Barracuda Networks, BECs accounted for 28% of all spear-phishing attacks aimed at educational institutions, while for all other verticals it was 11%. In addition, within education 57% of malicious emails came from internal – primarily students' – email accounts.

"We found that the students don't use email and administrators aren't always paying attention to those accounts," says Mike Flouton, vice president of Barracuda's email security business. "From an attacker's perspective, it's just much easier to go unnoticed."

The research, released today, is based on an analysis of more than 3.5 million spear-phishing attacks, including attacks against more than 1,000 educational institutions from June through September 2020. The point of the research, Flouton says, was to show the education community just how vulnerable it is to BEC attacks, along with the need to improve training and overall security awareness.

(Image: Barracuda Networks)

In the past 18 months, several BEC cases at school districts came to light. Most recently, a school district in Clark County, Nevada, refused to pay a ransom after a hacker stole private data on thousands of students. As a result, the student data was released on an underground forum.

In another example, Manor Independent School District in Texas reported in January that a seemingly typical school-to-vendor transaction resulted in a loss of $2.3 million. And in April 2019, attackers used a fraudulent email to steal $3.7 million from Scott County Schools in Kentucky.

"K-12 schools are much more vulnerable than colleges and universities, as they have more reliance on email for work orders and communications … with a less mature security posture and less IT staff and … training," says Ruthbea Yesner, vice president, government insights, education and smart cities at IDC. "As a result, combined with online work because of the pandemic, we have seen a rise in ransomware and other attacks on schools. The dollar value may be lower as compared to a bank, but that's only because the hackers want to get paid and they know the capabilities of schools are limited. 

Tim Keeler, founder and CEO of privileged access security provider Remediant, points out how the education sector has become disproportionately vulnerable to BECs during the pandemic. Security teams at colleges had limited time to secure the perimeter as students, staff, faculty, and researchers were sent home to work remotely, he says. Similarly, K-12 schools were focused on setting up and enabling a blended remote/on-premises classroom and had limited time or appetite for security awareness training.

"Both colleges and schools make great targets for attackers looking for notoriety and media coverage as they are highly visible entities, yet are price-sensitive," Keeler says. "Unfortunately, the education sector has perpetually underinvested when it comes to security tools, best practices, and [full-time employees]."

BEC Prep Lesson Plan
The Barracuda report offers schools districts four tips to better prepare for BEC attacks:

1. Invest in protection against targeted phishing attacks: Attackers realize the education industry doesn't always have the same level of security sophistication as other verticals, and they take advantage of it. Schools, colleges, and universities need to prioritize email security that leverages artificial intelligence to identify unusual senders and requests. This additional layer of defense, on top of traditional email gateways, will offer substantial protection against spear-phishing attacks for both staff and students.

2. Deploy account takeover protection: Educational institutions are more susceptible to account takeover than an average organization because many don't have the necessary tools and resources to protect against this threat. Invest in technology that will let the organization identify suspicious activity and potential signs of account takeover.

3. Improve security awareness education: Educate users about BECs and other email threats. Ensure that staffers and students can recognize attacks, understand their fraudulent nature, and know how to report them. It's especially important now when remote learning has become such a big part of the education system and students and teachers rely on technology and email for both communication and educational purposes.

4. Set up internal policies to prevent wire transfer fraud: All organizations should establish and regularly review existing school policies to ensure personal and financial information gets handled properly. Help employees avoid making costly mistakes by creating guidelines and putting procedures in place to confirm all email requests for wire transfers and payment changes. Require in-person or telephone confirmation and/or approval from multiple people for all financial transactions. Remember: It's not always about the technology. Creating policies and procedures that people understand and will follow can go a long way to preventing attacks.