Baltimore County school board approves $1.7 million for services following ransomware attack

Baltimore County’s Board of Education has approved more than $1.7 million in contracts for services required following the crippling ransomware attack on school systems in November.

Administrators told board members Tuesday that they expect the school system’s cyber insurance to reimburse up to $2 million for direct costs caused by the ransomware attack and up to $3 million in cyber liability coverage. The attack took place the day before Thanksgiving and canceled classes for students for five days.

Four of the contracts totaling about $1.2 million were approved with vendors recommended by the insurer as part of a single claim, for which Baltimore County Public Schools will pay a $5,000 deductible. The vendors provided schools with services related to ransomware negotiations, forensic investigation and triage, data recovery and public relations consulting services.

The county school system may still be on the hook for a fifth contract with the Virginia-based CGI Technologies, costing nearly $2,030,000 for services related to moving financial and human resources information to a cloud-based system. The contract was first approved in December for $1,505,000 and amended Tuesday to account for an additional $525,000 in estimated consulting fees.

George Sarris, the school system’s executive director for fiscal services, said the system will submit a claim to the insurer for the contract with CGI Technologies — but cautioned that it related to an enhancement of services, which is not directly covered.

Board member Kathleen Causey voted against approving the contracts after questioning administrators whether they should have been disclosed to the public sooner. Staffers replied that school board members were told of the “emergency” contracts in December during a closed door session and they should not have come as a surprise. Board members Julie Henn and Russell Kuehn abstained from the vote.

Administrators also disclosed a new $25,000 contract to retain the Michigan-based law firm McDonald Hopkins LLC for specialized legal services related to the ransomware response. The contract, which is covered by insurance, received sign-off from Baltimore County government’s attorney as required by Maryland Code.

Hackers seized control of county school district systems the day before Thanksgiving, forcing the district to cancel online classes for two days. The district has said no personal information was stolen, but has not disclosed the extent of the attack nor any ransom demands.

The school system is still recovering from the devastating attack, but has fared better than Baltimore City government, which experienced a similar attack in 2019. The city, which did not have cyber insurance at the time, spent about $10 million on recovery efforts and reported a loss or delay on $8.2 million in potential revenues.

___

(c)2021 The Baltimore Sun

Visit The Baltimore Sun at www.baltimoresun.com

Distributed by Tribune Content Agency, LLC.