When you get anti-hacking advice, you’ve probably heard “Don’t use a simple password,” or “Don’t plug in that USB you found on the ground.” But there’s one form of hacking that doesn’t always require a computer, and it costs businesses about $4.88 million a year.

Hackers who sought $40 million in ransom from the Broward County Public School District, which refused to pay, have now published nearly 26,000 stolen files.