A former IT employee of an Iowa school district has been sentenced to 21 months in federal prison for a sustained cyberattack against their former employer. The attack disrupted classroom operations, deleted user accounts, and inflicted tens of thousands of dollars in damages, according to court documents.
No CVSS score or CVE identifier applies here, as this was an insider threat rather than a software vulnerability. The attack unfolded over an extended period, with the ex-employee leveraging their knowledge of the district's systems to cause maximum disruption.
The former employee used privileged access retained after their departure to delete accounts and impair network functions, leading to classroom downtime and remediation costs. Specific indicators of compromise were not detailed in public records, but the attack targeted core administrative and educational systems.
The district worked with law enforcement and cybersecurity experts to restore services. The sentencing, handed down in federal court, also includes a period of supervised release. No further technical mitigation measures have been disclosed.
The case highlights the persistent danger of insider threats in educational institutions, where former staff may retain system access. It underscores the need for organizations to revoke credentials promptly upon employee separation and monitor for anomalous behavior.