School district recovers from cyberattack with zero data loss. Zero ransom paid. Zero school days lost.

The Challenge

Blaine County School District (BCSD) operates eight K-12 schools with an enrollment of 3,200 students. Its mission is to inspire, engage, educate, and empower students. “Technology has become incredibly important to the day-to-day operations of a school district,” says Paul Zimmerman, Director of Technology. “During a cyber event technology comes to a standstill, meaning the district can’t unlock doors, process work orders, or put curriculum on a projector. When systems are down, learning is down.”

In 2024, educational institutions were targets of 116 confirmed ransomware attacks with an average demand of $847,000.[1] Asked by the BCSD Superintendent to prepare a disaster recovery plan, Zimmerman looked closely at the backup solution he’d inherited. “Most backup systems can restore data,” he says. “The difference is how quickly they can do it. Our Superintendent wanted a 48-hour restoration target, and the existing solution couldn’t deliver.”

[1] Comparitech, “Ransomware Roundup: 2024 End-of-Year Report,” January 9, 2025.

The Solution

Evaluating leading data protection solutions, Zimmerman and his team selected Cohesity Data Cloud. “One deciding factor was Cohesity’s hybrid approach—backing up to modern appliance on-prem plus Cohesity FortKnox in the cloud—because I’m a big fan of storing data in more than one place,” Zimmerman says. “Cohesity’s immutable backups give me confidence that we can restore systems after a catastrophic event. And I like that I can manage everything from one interface.”

BCSD implemented the Cohesity solution in November 2023. The timing was fortunate. Just two days later, the Saturday before Thanksgiving, the district was hit by a cyberattack. “I was getting ready to sit down with my family when I started receiving text messages that certain systems had gone offline,” says Robbie Heidbreder, a computer technician for the district. Logging in, he and Zimmerman saw that despite their security defenses, 60% of the district’s virtual environment had been encrypted.

They immediately put the disaster recovery plan into action. Step one was turning off all network access to prevent further damage. Step two was contacting a forensics specialist to identify the attacker’s point of entry, and Cohesity to help recover critical systems from Cohesity FortKnox. “Who better to help me recover in a disaster than the partner that stores the data we need to recover after a disaster?” Zimmerman asks. “After the cyberattack, we recovered critical systems from Cohesity FortKnox in 48 hours and resumed normal operations just six days later–before students returned from holiday break. Other organizations around the state that were hit by the same ransomware actor needed several weeks to recover.”

By the time schools re-opened on Monday, the district’s technology was operating normally. “The only impact of the cyberattack on users was receiving a new Active Directory password,” Zimmerman says. “I’d call that miraculous.”

The Results

The district appreciates having Cohesity in its corner. “Cohesity saved the day after the attack by immediately helping us get systems back up,” says Heidbreder. Zimmerman agrees: “Cohesity is a good partner. We know that another cyber event will happen, and we’re well prepared.”

Simpler management, with a unified interface for on-prem and cloud backups, has lowered costs. “We used to have two full-time people dedicated to backups,” Zimmerman explains. “Since we switched to Cohesity, management takes so little time that the staff shares responsibility.”

Now BCSD is exploring the potential of using Cohesity Gaia, the conversational AI tool, for AI-powered search and reporting.

Reflecting on the cyberattack, Zimmerman says, “The biggest misconception about school cybersecurity is that it’s not going to happen to you. Yes, it is. And you need to be ready.”