CYBERSECURITYHow MIT Students Are Helping to Prevent Cyberattacks

By Nicole Estvanik Taylor

In May 2019, the government of Baltimore, Maryland, fell into chaos. Cybercriminals had locked the city out of many of its critical files and demanded payment to decrypt them. The city refused to pay ransom. The attack incapacitated a swath of services, including real estate transactions and bill payment, and recovery costs soared into the millions.

The syllabus of class 11.074/11.274 (Cybersecurity Clinic), a course in the MIT Department of Urban Studies and Planning (DUSP), includes a case study on Baltimore’s situation as an example of increasingly common ransomware attacks on municipal governments and other public agencies. To counter such threats, Lecturer Jungwoo Chun and Ford Professor of Urban and Environmental Planning Lawrence Susskind launched the MIT Cybersecurity Clinic in 2019. They have offered the course nearly every semester since.

Much like a legal or medical clinic, the course doubles as hands-on training for students and a pro-bono service to at-risk communities. After completing instructional modules and passing a certification exam, students are assigned in teams to a client. By the end of the semester, each team creates a report assessing the client’s vulnerabilities to cyberattack and recommending steps to improve protection. So far, the clinic has provided more than 40 assessments, confidential and free of charge, primarily for New England municipalities and health-care organizations.

In 2025, the FBI’s Internet Crime Complaint Center documented an average of 2,765 cyberattacks targeting Americans every day. When these attacks strike cities and towns, the fallout goes beyond finances, says Chun: “There’s a terrifying, cascading effect on every dimension of our lives.” 

In recent years, cyberattacks targeting the kinds of client communities served by MIT’s clinic have imperiled water supplies, impeded 911 and police services, and exposed citizens’ personal data.

Despite being gateways to essential infrastructure, many small municipalities and hospitals lack in-house staff trained in cybersecurity. Demand for such experts far exceeds supply in today’s labor market, and public sector budgets rarely can match the high salaries private companies offer qualified candidates.

According to Comparitech, from 2018 to 2024, there have been 525 ransomware attacks on U.S. government entities, approximately one every five days, leading to an estimated $1.09 billion in downtime costs.  

“Underfunded public and not-for-profit bodies need to follow a self-help pathway,” Susskind says. “There are many low-cost moves that these organizations can implement with a little coaching from a free-service clinic.”