Cyberattack on Cobb schools enabled by weak password, police say

Students are dropped off at a Cobb County school. (AJC file photo)

Combined ShapeCaption
Students are dropped off at a Cobb County school. (AJC file photo)

An attack on the Cobb County School District’s crisis management system that forced all schools into lockdown last month happened because of a weak password, according the police.

The password was not created by a school district employee, but a worker with the AlertPoint security system used by the district, police said.

The investigation into the Feb. 2 incident remains active, according to Sgt. Wayne Delk.

“They are still working on this and it’s obviously a difficult case to work because they had to track down how the breach occurred,” he told The Atlanta Journal-Constitution.

The Cobb school district said in a statement Tuesday that as soon as the police department completes its investigation, “we will know how the instructional day was interrupted by this targeted, external attack.”

ExploreParents question Cobb schools ties to company involved in Fla. bid scandal

At the time of the incident, Cobb schools officials said an AlertPoint system “malfunction” caused employees to receive a message indicating an active alarm. That led staff members to place all schools and campuses into a code red lockdown, which the district said “led to a high degree of anxiety for some students and staff.”

After investigating the incident, the district later said the alarm was intentionally set off and was likely a targeted attack” on its AlertPoint system.

The district began using the system in 2017. It has praised AlertPoint’s technology, which allows teachers and staff to alert officials of any emergencies within schools.

“We do not yet know the motives of those attacking the district’s AlertPoint system,” the school district said Feb. 24 in a statement. “However, it appears the crime was committed to disrupt education across the district, create district-wide chaos, and produce anxiety in the district’s students, parents, and staff. This was not a ‘prank,’ nor will it be treated like one.”

ExploreMore stories about Cobb County Public Schools

Delk said the police department is using the Cobb incident to encourage people and companies to create strong passwords, particularly when they are guarding sensitive information. Strong passwords use a combination of capital and lowercase letters, numbers and symbols.

Delk also said people and businesses should change their passwords often and avoid using passwords that would be easy for someone to guess based on their lives.

“A lot of people are using these simple passwords and I think that’s what happened in this case,” he said.

Anyone with information about the AlertPoint investigation is asked to call the Cobb County Police Department’s tip line (770) 499-4111 or the Cobb school district police department’s tip line at (470) 689-0298.