How Families Can Respond to School Cyberattacks | Hush on FOX 5 DC

Anchor: Well, a recent cybersecurity incident in the DC public school system has exposed some sensitive information on its students. That includes their home addresses and birth dates. And now the school system is trying to make sure that parents and the students remain safe with this breach having taken place. We're going to talk a little bit about how it happened and what parents need to do to protect their child and themselves. We welcome in Mykolas Rambus, the co-founder and CEO of the digital privacy firm Hush. Mykolas, thank you so much for joining us here. This is very scary for a lot of parents when they realize that this information goes out.

Mykolas Rambus: It is. It sadly happens more often than they recognize, but nevertheless, it's disruptive when it happens, to say the least.

Anchor: So, based on what we know, they've given out names, birth dates, student IDs, home addresses. That's what was potentially accessed. Just how dangerous is this specific information, and to whomever made this breach?

Mykolas Rambus: So, in the wrong hands, it can be very dangerous. There are two things we really want to think about right now. One is watching out for those young people's credit reports and financial fraud committed against them. In fact, the highest-growing population that has fraud committed against them is students, because they, and usually their parents, aren't paying attention to their credit file. The other unfortunate risk is highly personalized scams. You've heard about catfishing or sextortion, some of those things that are out there. Many parents haven't, unfortunately. That's what they've got to be very sensitive to and watching out for right now.

Anchor: When it comes to phishing, I mean, we all hear about them. We always get a lot of different texts, or even now, unfortunately, some phone calls where it can be very misleading, and at times they're doing a really good job of advancing the way that they're trying to catch you into something. What are the red flags, and what are the things parents need to pay attention to should they get some of these texts or phone calls where somebody's trying to scam them?

Mykolas Rambus: So the number one thing we can look out for is a scam that is forcing urgency. You have to do this right now. You've got to call immediately. You've got to send money right this second. It's urgency that those scams really prey upon. The other thing is being out of contact. One of the things scammers will do is look at a kid's social media and find out when they're in class or at a game, and they will literally time their scam for when that child is unavailable. So, number one, being able to be in contact with your child at all times, as best as possible, and recognizing that urgency is always a red flag.

Anchor: When it comes to children's identities, they may not have all the credit that an adult would, should their information be breached, but this is still something that those trying to make these attempts can take advantage of. So, when it comes to a child's credit and their financial standing, what do parents need to do to try to protect their child?

Mykolas Rambus: So there are a few steps they can take. It's free to do for any parent whose child has been affected. The first thing they can do is freeze those credit reports. They can go to Equifax, Experian, TransUnion, those are the three credit bureaus, and freeze their credit. Some have a downloadable app, some you can do through their website, but in any case, you can do it right from your mobile phone. It takes a few minutes at most. And not only should it happen for the child, but also for anyone else in the household. One of the things criminals do so often is take a bit of information about a kid and use it to try to financially defraud the rest of the family. So it takes about ten minutes in total to freeze the credit of the whole family. That's one thing they can do. The next thing, and I touched on this a little already, is the way these criminals learn about people, not only the kids but also the family, is from social media. So going back to those social media accounts, whether it's Instagram or Snapchat or otherwise, make sure the settings are set to private. Almost every six or nine months those policies change, so if you think it's secure but you're not really sure, the best thing you can do is go check. That cuts down a serious avenue the bad guys use to commit fraud.

Anchor: When it comes to freezing credit, how long do they need to do this for, and when is it safe to remove that freeze?

Mykolas Rambus: A lot of people believe, ourselves included, that the best way to freeze credit is indefinitely. The apps these days make it very easy. Let's say down the road that kid is applying for a college loan or a car loan, you can unfreeze it any time. But basically every person should have their credit set to frozen at all times unless they need to use it. So indefinitely is the answer, it should always be in that state.

Anchor: When is it safe to maybe open up new lines of credit for the students?

Mykolas Rambus: They'll go through life events certainly, whether it's applying for college loans, an auto loan, or maybe it's their first credit card. Those things happen, and the credit bureaus have designed these apps to make it really easy. It's a one-click press of a button to get that credit unfrozen, and then once you're done, you can refreeze it in a matter of seconds.

Anchor: You talk a lot at Hush, and you've touched on it already here, about reducing digital footprints and locking down personal privacy. You've already talked about some of the actionable steps. Is there more, beyond just the children's security, that families need to look into?

Mykolas Rambus: Sure. Most people, if they haven't Googled themselves, have probably Googled someone else. But maybe they haven't Googled themselves. There's a lot of information about all of us out there, whether it's a home address or a phone number. And these details might seem innocuous, for example, what high school you went to. But that same answer might be the same thing as a bank challenge question. They ask, "What's your school mascot?" It doesn't take someone long to put two and two together and figure these things out. Generally speaking, we live in an era where there's so much more information about all of us online, and bad actors are using artificial intelligence and other means to create very effective and convincing scams. What we can all do is go to these different websites that have our phone number or address, either for ourselves, our kids, or our parents, and ask for that information to be taken down. Almost all of these websites have a place, often in the fine print or the bottom of the page, that shows you how to get your information taken down. So whether it's that, pulling back your credit, or making your social media accounts private, there are lots of things you can do to make yourself safer. There's that old adage that you don't have to be the fastest swimmer to escape the shark, just faster than the next person. So much of what's happening in online fraud today is about whether you can be an undesirable target, so that criminals think twice instead of targeting you.

Anchor: So we've talked a lot about how to prevent this. What if somebody has already fallen into one of these scams, or already had their privacy breached, and realizes they're now in a dire situation? What are the first steps they need to take to get out of it?

Mykolas Rambus: Well, the first thing is making people aware. If one's credit has been breached, or something happens, the others in the household may not know something's occurred. They may get a phishing attempt, for example, by email or text saying they need money transferred, and it may have details about that individual that are extremely convincing, even private information. So making people aware in your core circle is a very important first step. From there, it's securing whatever accounts you can and changing passwords. You may have heard that adage about strong passwords that have letters, numbers, and characters. Those make a very big difference in regaining control of one's security should a breach happen. And then it's being aware that criminals are typically active for the next 18 months once someone has been hit the first time, once they've had their identity stolen or a fraudulent card opened in their name. So yourself, as well as your family, have to be extremely vigilant in that 18 months thereafter. It's why you so often see companies offer credit monitoring for some period after a breach, sometimes six months, sometimes twelve. It really needs to be 18 months, or even two years, until that risk has been reduced.

Anchor: You started this by saying, unfortunately, this happens way too often, and we do hear about it too often with our schools and public government offices as well. Why are they targets so often?

Mykolas Rambus: Unfortunately, in a lot of cases it's where the money is. The vast majority of criminality that happens online with cybersecurity and phishing is all about the money. It may not seem like a lot, $400, $500, or $100 here, or even thousands or millions in some cases, but it all adds up. If you were to add that aggregate amount across the world, you'd find it makes up what looks like, by 2030, the second-biggest economy in the world based on cybercriminal activity. It's just where the money is, unfortunately.

Anchor: You've given us so many good tips that, even without a breach, are important for people to be aware of and to take those extra precautions. Anything else worth leaving with the parents or students who were part of this?

Mykolas Rambus: The main thing I would say is just to be aware. As long as we know that these scams happen, we're aware of these pressure scams, this phishing, this artificial intelligence, just being aware is half the battle. We often say in our business that it's a failure of imagination. If you know what could happen, you'll be five steps quicker in being able to avoid it.

Anchor: How often are they able to catch the people actually doing the scamming?

Mykolas Rambus: It's very rare that people behind these get caught. Yes, you'll see some big press releases about groups being taken down, but by some estimates there are tens of thousands of people who are either voluntarily or have been trafficked into committing these kinds of crimes. They may occasionally catch the person running a large operation, but sadly most of these crimes go unprosecuted. And if they do get some of your money, you're not going to be able to get that back. That's pretty much certain. So protect yourself before that happens.

Anchor: And unfortunately, this breach did take place in the DC public schools. So if you have a child that was there, you need to make sure you take those extra precautions to keep your child and your family safe, because as you just mentioned, it can go well beyond the child and into the family as well. Thank you for your insight and your time. Again, if anybody wants more information, where can they get in touch with you?

Mykolas Rambus: They can learn more at gethush.ai. We have a ton of resources available for anyone to learn more about how to protect themselves.

Anchor: Okay, thank you again so much for your time and insight.

Mykolas Rambus: Thanks for having me.