The Keene School District has recovered the majority of the funds it lost due to a cyberattack that was discovered in August, a district official said Wednesday.

“We’re fortunate to have gotten the lion’s share of it,” said Tim Ruehr, the district’s chief financial officer. He said the district’s banking partner has recovered roughly $1.9 million of the approximately $2.1 million that was taken through a series of electronic transfers made through the Automated Clearing House, or ACH transfers. Ruehr didn’t have a timeline for recovering the remaining funds because of an ongoing investigation by law enforcement. The fraudulent transfers began in March and continued undetected until August, he said.

Ruehr said the team of investigators for the attack has not found any evidence that personal information of students or staff was compromised, and said the incident appears to be isolated to the loss of funds.

The attack was discovered due to anti-fraud measures the SAU’s business office had been implementing. The cyberattack was discovered while the latest security addition, an electronic money-transfer monitoring system, was being implemented, according to Ruehr.

“And they’re still trying to make withdrawals to this day,” Ruehr said. “We’ve determined that with some accounts, [ACH transfers] are just not allowed.”

The Keene School District has been upgrading its fraud detection measures over the past few years, according to Ruehr. In addition to a three-step verification process for most checks written by the district, Ruehr said the accounts that require ACH transfers, such as IRS payments, now have an additional confirmation email sent to staff that must be approved within a certain period of time.

“It’s a lot more emails, sure, but that’s the way it has to be now,” Ruehr said.

From 2016 to 2022, more than 1,600 schools across the country reported being the target of security breaches, according to the K12 Security Information eXchange, a nonprofit researching cyber threats against schools. These breaches include ransomware attacks, as well as other cyber incidents resulting in school disruptions and unauthorized disclosures. Keene isn’t the only school district in the state to have experienced a cyberattack this year. The Hudson School District was the victim of an apparent cyberattack in June that left the district without the use of its networks and phone system, according to reporting by the Union Leader.

These articles are being shared by partners in the Granite State News Collaborative. For more information, visit collaborativenh.org.