Class is in session—for cybercriminals. [OMITB]

Selena Larsen and Dave Bittner introduce the episode, which focuses on the various cybersecurity threats impacting educational institutions, from K-12 to universities, as they navigate the back-to-school season. The hosts discuss recent ransomware incidents, the threat landscape involving cybercriminal gangs, and the importance of awareness and preventive measures for students, teachers, and administrators.

The hosts highlight the increasing number of cyberattacks targeting educational environments, emphasizing how these attacks disrupt learning, compromise sensitive student information, and result in financial damage. They specifically discuss ransomware, supply chain attacks, and the exploitation of educational platforms such as Canvas, which was affected by a breach that exposed personal data of millions of users. The conversation underscores the vulnerable underfunded status of many public schools and universities, making them prime targets for cybercriminals.

The podcast delves into a recent incident where a hacking group called Shiny Hunters exploited a vulnerability in Canvas, an educational platform used across many institutions. This breach exposed personal information—names, email addresses, student IDs, and communications—impacting approximately 275 million users. The discussion reflects on how the breach highlights the risks of outdated software, the importance of timely patching, and the sensitive nature of educational data that includes emotional and behavioral information.

The discussion shifts to espionage activities focusing on university research, with examples of Chinese and North Korean threat actors targeting scientific and technical data. The hosts describe a recent campaign exploiting vulnerabilities in webmail servers (specifically RoundCube) to access sensitive research data at universities. They stress the importance of keeping software up-to-date to mitigate risks of older vulnerabilities being exploited.

The hosts explore common scams that prey on university students, including job fraud and online scams. These tactics often involve fake job offers, fake checks, or malware disguised as legitimate employment opportunities. The risk is heightened for international students or those from vulnerable backgrounds who may fall victim due to the hope of earning money or gaining opportunities. The conversation emphasizes that falling victim to scams is never a moral failing, and awareness is key.

Selena and Dave stress the importance of proactive cybersecurity practices in schools, such as timely software patches, the use of secure email gateways, and awareness of common scams. They mention resources from CISA and other organizations to help educational institutions improve their defenses. They also discuss the benefits of using devices like Chromebooks that store data in the cloud, making recovery easier in case of attacks.

The hosts share personal anecdotes about their own college experiences and reflect on the current digital challenges faced by children, including exposure to online exploitation, cyberbullying, and the influence of AI chatbots. They emphasize the importance of open communication, awareness, and responsible use of technology by parents and guardians to protect young users.

The episode concludes with a hopeful note about the potential for more community involvement, such as PTA efforts, to bolster cybersecurity awareness. They speculate that the cybersecurity landscape will continue to evolve with new threats, but that awareness and resource sharing can help mitigate risks. The hosts remind listeners to enjoy their educational journeys and stay vigilant against cyber threats.