Target Sector: Education & Emergency Services
Court filings, technical advisories, and SEC Form 8-K enforcement disclosures documenting cyber intrusions against organizations in Education & Emergency Services.
Key Facts
- 6 documented prosecution and advisory matters targeting Education & Emergency Services.
- Cumulative reported financial losses exceed $696.0 million.
- 3 of 6 cases reached conviction, guilty plea, or final sentencing.
- Tracked actors include LockBit Ransomware Group, Evil Corp, REvil / Sodinokibi.
Documented Incidents (6)
U.S. v. Khoroshev et al. (LockBit Ransomware Operation)
Comprehensive global law enforcement takedown (Operation Cronos) of LockBit ransomware infrastructure, unmasking creator Dmitry Khoroshev (LockBitSupp) and multiple active affiliates who extorted over $500 million from thousands of victims.
U.S. v. Yakubets & Turashev (Evil Corp / Dridex Banking Malware)
Leader and core administrator of Evil Corp charged with deploying Bugat/Dridex banking malware and ransomware, stealing dozens of millions of dollars from bank accounts of municipalities, school districts, and businesses.
U.S. v. Vachon-Desjardins (Netwalker Ransomware)
Affiliate of Netwalker ransomware responsible for attacking dozens of healthcare systems, universities, and businesses during the COVID-19 pandemic, extorting tens of millions of dollars.
U.S. v. Yaroslav Vasinskyi (Kaseya VSA / REvil Ransomware)
Ukrainian national and REvil ransomware affiliate responsible for deploying the ransomware attack that hijacked Kaseya VSA management software, instantly encrypting up to 1,500 downstream businesses on July 4th weekend.
U.S. v. Tyler Barriss (Serial Swatting / Wichita Incident)
Perpetrator of dozens of fraudulent emergency 911 calls and bomb threats across the United States for hire, culminating in a fatal police shooting in Wichita, Kansas, over a Call of Duty video game dispute.
SEC v. Blackbaud, Inc. (Misleading Ransomware Disclosure)
Landmark Securities and Exchange Commission enforcement order against public cloud software provider Blackbaud for making materially misleading disclosures concerning a May 2020 ransomware incident, omitting that attacker had exfiltrated unencrypted donor bank account and social security information while asserting sensitive data was not compromised.