More than half of K-12 schools reported cyber incidents amid staffing, funding gaps

A majority of K-12 schools and districts experienced a cybersecurity incident in the past year, with staffing shortages, budget constraints and gaps in artificial intelligence policies complicating efforts to protect school systems, a new report said.

The report, released jointly Tuesday by the Center for Internet Security (CIS), the Multi-State Information Sharing and Analysis Center (MS-ISAC) and the Consortium for School Networking (CoSN), evaluated the cyber threats facing U.S. K-12 schools and districts through the survey responses of 426 K-12 cybersecurity and technology leaders, which were gathered between August and September of this year. 

The survey also looked at schools’ capacity to defend against attacks and the security challenges associated with AI tools as adoption is outpacing the establishment of policies and safeguards. 

Of the surveyed schools and districts that said they experienced a cyber incident within the past year,34% said that incident affected day-to-day school operations. But 66% of those schools and districts also said they have only one or two dedicated cybersecurity staff members. 

School leaders said this lack of dedicated personnel for cybersecurity limits their ability to monitor threats, respond to incidents and maintain defenses while also supporting everyday technology operations. 

The report further detailed the gap between schools’ cyber responsibilities and their capacity to fulfill them: almost 80% of respondents said they needed additional cybersecurity support, resources or guidance; 56% said their cybersecurity programs were underfunded; and 70% said budget constraints had forced them to delay cybersecurity projects, technology investments or staffing.

“I think most school districts are prepared to deal with just about any type of incident they may face, from weather events to pandemics to acts of violence. We’ve been training and drilling those for decades,” said Michael Patton, the superintendent of Saratoga Springs City School District in New York. “But when it comes to a major cyber event, I worry that most of us are not well prepared.”

Additionally, 87% of surveyed K-12 leaders said phishing or email compromises were among the leading cyber incidents affecting their schools and districts. Attackers have increasingly targeted user credentials for exploitation, rather than relying solely on technical vulnerabilities. The report also noted that AI can make phishing messages and impersonation attempts more convincing. 

Also, the consequences of those attacks extend beyond stolen information or compromised networks. Not only can cyber incidents disrupt classroom instruction, but they can also impact student information systems, communications, payroll and other essential services. This cascading effect also extends beyond just students and faculty to their families. 

Whether it’s spear phishing, phone calls, or mass emails, humans are curious and I believe want to help by nature. Criminals are criminals and usually will take the path of least resistance and prey on emotions. We know that a single compromised account is all it takes to advance toward a more lucrative target,” said Roy Park, the director of cybersecurity and digital privacy for the San Joaquin County Office of Education in California. 

The report made several recommendations for districts: strengthening their identity protection, multifactor authentication and email security; providing regular cybersecurity awareness training; establishing incident response and recovery plans; creating formal AI-use policies and assessing third-party vendors; securing leadership support for cybersecurity funding and staffing; and using available threat-monitoring services and information-sharing partnerships, like the MS-ISAC’s Malicious Domain Blocking and Reporting service. 

The report pointed out that districts that used the MS-ISAC’s Malicious Domain Blocking and Reporting service recorded nearly 800 billion attempts to access school and district websites and online services. The service also blocked 3.52 billion connections to known or suspected malicious destinations — which is an average of more than 3.1 million per protected organization — that could have exposed users to phishing, malware, credential theft or other cyber threats.

“Schools are working hard every day to improve cybersecurity, often with small teams and very limited resources. But the environment around them is changing quickly, especially as AI reshapes both the opportunities and risks for the K-12 community,” said Randy Rose, vice president of security operations and intelligence at the Center for Internet Security.

“The schools and districts that will be best positioned for the future are those that invest in the kind of cyber resilience that ensures a cyber incident doesn’t expand to a community-wide crisis,” Rose said.