- Oh.

We got a problem.

- [Isabella] Cyber attacks, they're often the stuff of fiction, but in Rhode Island, they've recently been a difficult reality.

- Cyber attacks are becoming more and more common across government and the private sector.

- [Isabella] In September, Providence Public Schools announced that they had been hacked by a cyber crime group called Medusa.

The group threatened to release private student and employee information online unless the school district paid a million dollar ransom.

They didn't pay and the information was leaked.

How common are attacks on schools?

- Unfortunately, very common.

- [Isabella] Douglas Alexander is the director of Rhode Island College's cybersecurity program.

- The combination of lack of time and resources for adequate security and the amount of sensitive data that they hold make them a prime target.

- [Isabella] According to the organization K12 SIX, there were more than 1600 cyber attacks on schools nationwide between 2016 and 2022.

Then it was reported in December that another cyber crime group called Brain Cipher hacked into Rhode Island's State benefits portal, which is used for programs like Medicaid and food assistance.

- So this one was a whole other level.

Even in a state as small as ours, we're still talking about hundreds of thousands of citizens' data, and that's a substantial percentage of our entire state population.

- [Isabella] Alexander says public institutions like these are more easily hacked than private corporations.

- [Alexander] Corporations can be like a submarine, right?

They're gliding stealthily underwater and they might put up one or two periscopes to connect with the outside world, so they're much more secure but schools and municipalities are like cruise ships.

They encourage people to come in, they encourage people to interact with them, and it just makes them inherently design-wise more vulnerable.

- I can't say I was surprised to see the cyber attacks.

They are, of course, unfortunate, but they're so pervasive.

- [Isabella] Former Rhode Island Congressman Jim Langevin has been working on cybersecurity for nearly two decades.

He says the field has changed a lot.

- When this all started originally, it was like your individual maybe kid hacker that was good at computers and I think we've all seen the "WarGames" movie with Matthew Broderick.

- [Computer] Shall we play a game?

- Oh.

Later.

Let's play Global Thermonuclear War.

- But as more businesses connected to the internet, the hackers started to go after those institutions.

- Cyber attack at Sony Pictures.

- The credit report company Equifax.

- Colonial Pipeline says it was hit by ransomware.

- How do people make money off of hacking a system?

- The most common way is ransomware, which means that once they gain access to a system and the system's data, they deploy a program that encrypts it, makes it inaccessible to the users of that data, which essentially holds it hostage.

- [Isabella] Imagine a hospital that can't access any patient health records or a business with no way to track inventory.

It can bring an organization to a standstill and a choice between rebuilding everything from scratch or paying up.

Many businesses do pay ransoms, but don't publicize it for fear of attracting more attacks.

According to Interpol, ransomware attacks increased by 70% in 2023.

- I believe it's because of the rise of the use of cryptocurrency.

Bad guys can get paid in cryptocurrency and then it's virtually untraceable.

- [Isabella] Besides ransoming a system, hackers can also steal personal data and sell it.

- By some estimates, a stolen credit card number on the dark web is worth about $5.

A stolen medical record, worth 75 to 100 dollars or more.

- [Isabella] It's a process that Douglas Alexander says has become even easier because of a trend called credential stuffing.

- What people don't understand is that there are about 30 billion passwords already publicly available from all the breaches that have happened in the past that you can just pull out and say, "Ah, here's someone's account that got stolen from LinkedIn.

I'm gonna try it on Gmail, I'm gonna try it on the bank."

And they can do this at scale with hundreds of millions of accounts at a time and just see what hits.

- [Isabella] But it's not just Social Security numbers and medical information that's at risk.

While in Congress, Langevin grew concerned about how hackers could attack infrastructure, like water treatment facilities, banking systems, or even electrical grids.

- I was chairing a subcommittee on the Homeland Security Committee that had jurisdiction over cybersecurity.

And I can remember my staff director coming into me one day and saying, "Boss, you've gotta get a classified briefing on a vulnerability to our critical infrastructure, particularly our electric grid."

And they begin to brief about how they found a vulnerability to our electric grid through what's called a SCADA attack.

- [Isabella] Engineers use Supervisory Control and Data Acquisition, or SCADA systems, to control industrial equipment remotely.

Scientists demonstrated for Langevin what could happen if the system controlling a turbine generator, which generates electricity by spinning, was hacked.

- You see the generator operating normally, and then all of a sudden, the generator starts to kind of spin up even further, generating more energy beyond its capacity basically.

And all of a sudden, the generator starts to shutter and smoke and became inoperable.

And to me, that was the wake up call because I saw clearly how a cyber attack could actually cause physical damage.

- [Isabella] Today, he also worries about how artificial intelligence will impact security.

- There'll be advantages because AI will help us detect anomaly, threats, and cyber intrusions and attacks probably more quickly.

But also the bad guys will use artificial intelligence to their advantage too.

So things like deep fakes trick you into taking an action that you otherwise might not take.

- Do you think defense is keeping up with the pace at which attacks increase?

- No, I don't think defense keeping up with the attacks.

Laws and regulations have not caught up with technology and the technology threats and that needs to change.

- [Isabella] The former congressman has teamed up with Douglas Alexander to start a cybersecurity institute at Rhode Island College, and they're working with the state to encourage a more proactive approach to cybersecurity.

What should people be doing to protect their identities?

- I think the most important thing is to freeze your credit.

But what it does is it presents any bad actor from pretending to be you and opening an account in your name.

- [Isabella] He also recommends keeping your logins private, using multifactor authentication, varying your passwords, and being aware of common scams.

- This isn't something that is the provenance of just computer geeks, it's now for everybody to think about and learn about.