Ricoh's Ransomware Containment for K-12
                     Use Case: 
Ransomware Containment for K-12 
Protect your school with best-in-class ransomware defense.
With more reliance on digital learning tools, greater access to connected devices, and large volumes 
of sensitive data, today’s schools are experiencing cyber crime at an alarming rate. The consequences 
of these incidents can be crippling, and districts are paying the price with higher ransoms, complete 
shutdowns of student services and stolen personal information.
Cyber crime incidents in K-12 
education spiked to 7.3% in the 
2022 school year. A jump of nearly 
4.5% over the previous year.                        
IBM. X-Force Threat Intelligence Index 2023. 
January 2023
Today’s schools depend on technology. In the classroom, it supports teacher planning and student 
learning outcomes, while outside the classroom it powers everything from door access and security 
cameras to admin workflows.
In fact, technology is now so ubiquitous in education that 94% of schools in the U.S. provided laptops or 
tablets to students in the 2022-2023 school year1— and that number is only expected to rise.  
But in the last year, the K-12 education sector has experienced the highest rate of ransomware attacks 
out of any industry2,  with 8 out of 10 districts or schools being affected. 
Challenges facing K-12 schools and districts in preventing ransomware attacks:
• Limited funding and staffing resources for cybersecurity 
• Growing number of attack vectors for ransomware
• Larger attack surfaces for cyber criminals to exploit
• Rapid tech adoption and highly connected digital classroom tools 
1 The Journal. School Pulse Panel. September 2022.
2 The Journal. School Pulse Panel. September 2022 1
Ransomware containment is a race against time. 
Ransomware can encrypt up to 50,000 files per minute.1 
Even with traditional perimeter-based security solutions, ransomware attacks can go unnoticed for days, 
if not weeks, before being detected — and all it takes is to get through one endpoint. Unless there’s 100% 
protection, 100% of the time, it’s only a matter of time before K-12 IT leaders are faced with an attack. 
Fortunately, schools and districts of any size can stop a ransomware attack within seconds — even if it’s 
already begun, inside the network.  
Automated ransomware containment and isolation: a last line of defense for schools
RansomCare, powered by BullWall, is a software solution that works behind your firewall. It detects 
outbreaks in seconds, monitors data activity and immediately shuts down the source device to isolate and 
contain the spread of illegal file encryption. 
It doesn’t matter who triggered the encryption, whether it’s a known ransomware variant, on what 
endpoint the outbreak started, or if it was deployed by someone inside the school or not, RansomCare 
analyzes each file accessed by a user on monitored file shares either on-premise or in the cloud. 
When encryption or file corruption is detected, an alert is raised instantly, and a response is triggered to 
disable and isolate the device and user encrypting your data. If a few files are encrypted before the forced 
shutdown or disconnection, they are logged in a recovery list, allowing for a faster recovery that can be 
integrated with your backup system.
For K-12 schools, the advantages of ransomware containment are numerous: 
• Less downtime and shutdowns impacting student services and learning activities
• Fast and easy installation that does not require significant IT staffing resources 
• Immediate response and isolation reduces expensive recovery efforts, legal costs and even 
ransoms
• Works invisibly, with no impact on network, device or application performance 
RansomCare integrates with cloud solutions such as Microsoft 365 and SharePoint. In addition, 
integration through RESTful API to other security solutions such as Cisco ISE and Windows Defender 
ATP means your security teams can unify security management across an increasingly complex sea of 
endpoints.
Learn more about how Ricoh is protecting 
K-12 schools from the effects of 
ransomware. 
https://www.ricoh-usa.com/ransomcare
1  BullWall. 2023 Ransomware Report. August 2023
Ricoh, a trusted partner
At Ricoh, we’re empowering our customers to respond to our changing world with actionable insights. We believe having access to the right information 
translates to better business agility, more human experiences, and the ability to thrive in today’s age of hybrid and borderless work. Through our people, 
experience, and solutions, we create competitive advantage every day for over 1.4 million businesses around the globe. To us, there’s no such thing as too 
much information.
Ricoh USA, Inc. 300 Eagleview Boulevard, Exton, PA 19341 | 1-800-63-RICOH
©2023 Ricoh USA, Inc. All rights reserved. Ricoh® and the Ricoh logo are registered trademarks of Ricoh Company, Ltd. All other trademarks are the property 
of their respective owners. The content of this document, and the appearance, features and specifications of Ricoh products and services are subject to 
change from time to time without notice. Products are shown with optional features. While care has been taken to ensure the accuracy of this information, 
Ricoh makes no representation or warranties about the accuracy, completeness or adequacy of the information contained herein, and shall not be liable for 
any errors or omissions in these materials. Actual results will vary depending upon use of the products and services, and the conditions and factors affecting 
performance. The only warranties for Ricoh products and services are as set forth in the express warranty statements accompanying them. 2