TRC switches gears from ransomware attack to remote classes for COVID-19

Just as Three Rivers College nears the end of a ransomware investigation, students and faculty will make the shift to remote coursework in response to COVID-19.

Students returned to class Monday after three weeks off due to spring break and the ransomware attack, but starting this coming Monday they’ll be doing all possible classwork online.

Dr. Wesley Payne, president, said attendance Monday and Tuesday was higher than expected with most students there.

The ransomware attack came Tuesday, Feb. 25, when IT staff discovered a disturbance. It was later discovered to be a RYUK strain of ransomware virus. Since then, the team has been working daily to bring things back up and running.

It was total attack, Payne said, “it was a pretty successful attack as far as attacks go.” However, no student data was “exfiltrated” or “misued” at this point in the investigation.

Payne said the investigation is coming to an end soon and there’s been no data that couldn’t be recovered or recreated.

“We will be able to recover fundamentally everything that was encrypted without paying,” Payne said.

According to the financial report presented to the Board of Trustees on Wednesday afternoon, the college spent about $15,389. Most of this went toward equipment and IT supplies while the remainder went toward providing IT with overtime meals.

Payne said thanks to the cybersecurity insurance the college has, the financial impact of the attack will be very low.

Chief Technology Officer Steve Atwood told the board his staff has been working since the attack was detected with 18-hour shifts for a while before dropping to 12-hour shifts. He said they’re working on returning to a normal schedule soon.

Atwood said they worked on restoring major systems first before moving on to the secondary ones. Payne said they learned from this experience how important technology has become to society.

“When technology works well, you do not notice it,” he said. “There’s things you absolutely stop thinking about. ... You go a little while and then you think ‘Wait.’ Our heating and air system is controlled by computers. If the temperature changes, whatever it’s set on now is what it’s going to be a for a while. Then you realize door locks are all computer controlled and we need to deal with that.”

The college is still trying to figure out how the attack came in. Payne said it’s possible they won’t find an answer to that question before the investigation ends.

“It could be something as simple as clicking on a link from an email or an attachment,” Atwood said. “That’s probably one of the normal ways that gets in.”

Payne said student records have been restored to the day before the attack and Blackboard services are running again, which will be important during the college’s next move.

“The truth of the matter is, we’re going from one virus to the next,” Atwood said. “We’re having to pivot from this to the impact of the coronavirus.”

Starting Monday, as much coursework as possible will be done remote or through virtual instruction.

“We decided not to wait for the first inevitable case in one of our communities,” Payne said.

Classes are canceled for the rest of the week, except for those Thursday evening classes that have not yet had class this week.

Payne said this is because they want to have face-to-face conversations with students about the situation, changes and how things will be run.

For those courses such as welding and nursing, Payne said lectures will be held online, but students will still have in-person labs.

Very few classes, Payne said, don’t include some form of online instruction already. Those that don’t will need to build the course on the fly.

Payne said professors and adjuncts will be trained before Monday on ways to implement remote learning.

The campus will remain open during this time. The Tutoring Center and Library will expand hours to be open from 8 a.m. until 8 p.m. Monday through Friday.

The Welcome Center will also expand hours at least next week to provide support. It will be open from 8 a.m. until 9 p.m. Monday through Friday.

“The anticipation is that as our students move to online instruction, they’re going to need more support in off hours than they normally do,” Payne said.

Payne said there hasn’t been much need to expand these services’ hours before now, but he expects a greater need with courses moving online.

The dorms will also remain open, Payne said. Students are allowed to check out and go home if they’d like, but for those who would like to stay that option is there.

“We have some students from areas that are much more impacted by coronavirus right now than we are,” Payne said. “They may very well look at that and go ‘No, I don’t think I want to go home to that. I think I’ll stay right here’ ... There is absolutely no reason we should tell those students to leave.

“They are as safe or safer here than they would be anywhere.”

Payne said his assumptions it that the majority of housing students will return home.

Looking forward to summer and fall semesters, Payne said the college will encourage students to register for classes online. This system is already set up, but it will be heavily encouraged.

It can be done in-person if a student is already on campus for other services.

“We are going to be in very frequent contact with our students over the course of the rest of the semester by email, by phone, by text,” Payne said. “We want to make sure they’re doing OK. We are pro-actively reaching out to them and discovering that there’s an issue before it becomes a big issue.”

Payne said he’s confident in the school’s staff and students to be able to make the transition and continue to what they need to.

“I was impressed with the college’s response to the RYUK ransomware attack,” he said. “I am phenomenally impressed with the entire institution’s response to our safe guarding measures in response to the coronavirus threat.”