Pinal County school officials confirmed to ABC15 that their data processing service consortium was attacked over the weekend, putting paychecks in jeopardy for some school employees this week throughout the 21 districts in the county.
What happened
An employee of the Casa Grande Union High School District says staff members were first told of a potential "glitch" in the system that could impact direct deposit paychecks on Tuesday.
Staff were told paper checks would be issued this week, but on Thursday afternoon, another email was sent out warning about concerns the county may not reach the deadline to issue paychecks.
In a statement, Pinal County Superintendent Jill Broussard told ABC15:
"The Pinal County School Office Data Processing Service Consortium was the victim of a ransomware attack this past weekend. Our staff has been working diligently, around the clock, to restore access to the data for our school districts. To our knowledge, our employee data has not been compromised. We will continue to investigate and update the districts. Most of the system has been restored and the districts have access, as of last night. Payrolls that were submitted prior to the attack have been processed as usual. We are moving forward with processing the remaining district payrolls with an expected distribution of checks on their regularly scheduled pay date."
'People need to be on guard.'
"Cybercriminals have figured out that by attacking schools, it's one-stop shopping," retired FBI Special Agent John Iannarelli told ABC15. "They have tons of information they can resell on the dark web. They also have money, taxpayer dollars that they can use to steal as well."
Iannarelli oversaw cyber-intelligence investigations and said there is a ransomware attack in the United States every 14 seconds. He says the FBI and law enforcement are very skilled at finding the hackers, but they are often hard to prosecute since they are overseas.
"Arizona is not alone," Iannarelli said. "There have been ransomware attacks on school systems around the country for millions of dollars and lots of lots of information. The crime is profitable to cybercriminals which means that crime is here to stay. People need to be on guard."
What districts are doing now
Some districts are working to finalize pay for employees this week, during a time in which some schools are entering fall break. With the first of the month just around the corner, bills, rent, and mortgage payments are due for many.
"It's not just our teachers. It's our custodians, these are our housekeeping staff, this is everyone," an employee in the district said. "I know of a lot of people that live paycheck to paycheck."
On Thursday evening the Florence Unified School District Issued the following statement to ABC15:
"Currently the Florence Unified School District is working very closely with leaders and staff in the Pinal County Schools Office. Pinal County Schools has worked around the clock to recover data and last night provided our business office with the access needed to complete our part of the payroll process. The FUSD business office worked through the night and into the morning to complete their portion of the payroll process. Tonight, we are waiting for Pinal County Schools to process and print paychecks for our employees. At this time, that part of the process is on hold as PCS is still working to restore that level of operation. As soon as we receive notice from Pinal County Schools that our paychecks have been printed, we have staff prepared to immediately begin sorting and delivering paychecks to school sites for employees to pick up. We are hopeful that we will be able to begin distributing paychecks to our employees at noon on Friday, September 29."
ABC15 learned Friday that the Casa Grande Union High School District superintendent has coordinated with their food service provider and is also working with the Salvation Army to provide food boxes for staff members who need them. Additionally, district officials say they are working to provide "emergency loans with no interest" that could be available as soon as Friday afternoon. The district also hopes to have letters from the district explaining the payment situation in an effort for financial institutions, landlords, and creditors to waive any late fees or insufficient funds penalties.
Still, the district is working to get payment to its staff members. CGUHSD says, "As soon as the county's system is up and running, live checks will be the quickest method to get staff the money they have earned. We will have a team at the district office to pass out paychecks as soon as we get them, even if it is over the weekend."
ABC15 spoke with Jennifer Kortsen who is with the district.
”It couldn’t have come at a worse time because we have people who are leaving on vacations, people are going out of the country” said Jennifer Kortsen with CGUHSD
Right as impacted educators and others were starting to rethink their fall break plans, Pinal County Superintendent Jill Broussard announced they’ll print over 4,500 checks to be given out at the over a dozen districts. Those districts include: Apache Junction, Casa Grande High School, Combs, Coolidge, Florence, Maricopa, Mary C. O'Brien, Oracle, Picacho, Sacaton, Santa Cruz, Stanfield, Superior, and Toltec
A few hours after the news, ABC15 started hearing reports of printing issues with the check.
“We sent people from the district to Florence to pick up those checks,” said Kortsen.
Going forward, the Pinal County School Superintendent said they’re working with Homeland Security and the FBI to investigate how the “data processing service consortium” or the system that processes their payroll was the victim of a ransomware attack.
In a phone call with ABC15, Broussard said about two months of data from some schools has gone missing following the attack, but we’re told none of it is personal information.
The cyber-attack may be hard to see, but the helping hands were out in the open right away.
”It makes my heart full anytime there something that happens, a tragedy or mishap, our community comes together,” said Kortsen
On Saturday from 8 a.m. to 11 a.m., Talbert says produce is available for those impacted by the pause in payment at 50881 W Papago Road in Maricopa, AZ 85139.
If you have information about this story or are experiencing problems related to the ransomware attack, you can email share@abc15.com.
