Allegheny Intermediate Unit investigates malware attack, avoids ransom payment

Allegheny Intermediate Unit alerted its employees Thursday afternoon to a recent malware attack on its data network but said there’s no initial evidence the perpetrator accessed sensitive information.

According to the employee notice, which was made available to the Tribune-Review, an “unknown entity” encrypted portions of the intermediate unit’s network and demanded payment of ransom to unencrypt the affected data.

“The AIU had backup versions of the most critical information and was able to restore access to the vast majority of the impacted files without engaging or paying the intruder,” interim Executive Director Rosanne Javorsky stated in the notice. “To ensure the integrity of our systems and avoid similar incidents in the future, we are reviewing our policies and procedures and continuing to enhance the security of our information systems.”

Working with independent forensic specialists, the intermediate unit said it has found no evidence that the perpetrator obtained any personal or protected information stored on its servers, but noted an investigation is ongoing.

As the analysis continues, the intermediate unit “will provide formal notification to any individuals whose sensitive information was contained on the servers that may have been accessible as a result of this incident,” Javorsky said.

She said the AIU issued the notice out of an abundance of caution and encouraged employees to monitor their accounts and contact their financial institutions about any unauthorized or unusual activity.

“We remain committed to the privacy and security of all information the AIU maintains,” she said.

Sarah McCluan, supervisor of communication services for the AIU, declined to comment on the time frame when the malware attack occurred, citing the ongoing investigation.