Cyber attacks are on the rise, and schools are becoming targets more often.

Why schools? An article in Forbes reports that the answer comes down to money—schools manage more than enough money to become an appealing target for criminals. And it’s only going to become more common: Alyson Klein reports in her article in EdWeek that the problem is only increasing as schools rely more and more forms of technology. As for who is carrying out these attacks, it depends on the case: anyone from bored students to offshore criminals can find a reason to attack a school’s files.

Understanding Types of Cyberattacks

Ever gotten an email from someone claiming you’d won a cash prize? Or maybe a text message from someone pretending to be a company you know, like Netflix, asking you to reset your password? These are forms of phishing, and they represent just one way cybercriminals can attempt to get private data.

Phishing

Phishing is a form of fraudulent solicitation via email or on a website. It can prompt someone to enter personal information while masquerading as a trustworthy entity.

Data Breach

Often called simply a “hack,” a data breach is when an unauthorized person gains access to sensitive, confidential, or protected information stored by your school.

Ransomware

A ransomware attack is when cyber criminals use malicious software to break into a school’s network and encrypt the data—so your school can no longer access it. As the word “ransom” suggests, they say they will only release the files back to the school if a certain amount is paid first. According to CNN, schools with limited cybersecurity measures are often the most vulnerable to ransomware.

Denial-of-Service Attack

This is known as a “crash”—when cybercriminals infiltrate a network with so many requests, it stops responding. This blocks those that need the network from being able to use it.

Pranks, Invasions, and Hacktivism

Online learning has given rise to pranks like “Zoombombing,” where an outside person gets into an online class and disrupts it with inappropriate—or even hateful— messages or images. Such pranks—which seem to stem solely from the desire to disrupt—can also occur in parent meetings, online performances, and over email. “Hacktivism” involves similar tactics and protests against school policies or changes.

What’s the Impact to Your School?

As a new academic year begins, a school district in Prince George’s County, Maryland, implemented new security measures to ensure the safety of its students. However, even before the school year started, the district fell victim to a cyberattack, highlighting the growing threat of ransomware attacks on educational institutions. The attack on Prince George’s County Public Schools followed a pattern seen in other districts, where threat actors infiltrate the computer network and demand a ransom for stolen data.

“Schools have this delicious trove of data and do not have the same protections as banks and other for-profit businesses,” says expert Jake Chanenson, lead author of a University of Chicago report on school district cyber risks.

In August 2023 alone, 11 K-12 school systems were targeted by ransomware gangs, and several more have reported attacks in the early months of the school year. (Read more about how the district responded to the attack and what it means for your school here: “It’s Back to School for Cyber Gangs, Too”)

Wasted Time

Often, schools must close during a cyberattack. According to a U.S. Government Accountability Office (GAO) survey, “loss of learning following a cyberattack ranged from 3 days to 3 weeks, and recovery time could take anywhere from 2 to 9 months.”

Wasted Money

GAO reports losses due to cyberattacks are significant. They include replacing computer hardware and enhancing cybersecurity to prevent future attacks.

Learning Loss and Other Harm

Cyberattacks disrupt learning with their impact on students, their families, and teachers. If systems are down, teaching and record-keeping cannot be conducted as planned. A 2020 GAO study found that breached grades, bullying reports, and social security numbers left students “vulnerable to emotional, physical, and financial harm.”

What You Can Do

The number of cyberattacks against schools is staggering: GAO reports that in 2020 there were 1,196,000 ransomware attacks alone. (Their reports include a list of the most notable incidents over the last few years, which you can find here: “As Cyberattacks Increase on K-12 Schools, Here is What’s Being Done.”) Many law and policymakers are calling for better support around cybersecurity for schools. President Biden signed the K-12 Cybersecurity Act in October of 2021, in an effort to ensure that school systems are equipped with the knowledge and resources to protect themselves. (Find the full article here: “Cyber Attacks on Schools: Who, What, Why, and Now What?”)

About the Author

Mohammad Ahmed is the founder and CEO of Infinity Technologies, offering technology solutions to schools, healthcare facilities, and government agencies. He holds an MBA in management information systems and has over 20 years of professional IT experience.

More resources:

Key Takeaways from the Cybersecurity for School Leaders Webinar

In today’s digital age, schools are the guardians of sensitive data—data that requires robust cybersecurity. To address that need, we hosted Cybersecurity for School Leaders with cybersecurity experts Mohammad Ahmed and Preet Singh from SoftwareMSP. You can rewatch the webinar here or read on for key insights. The Current State of Cybersecurity in Education The […]

Tuesday Tips: Cybersecurity with Expert Sangar Safi

In this session, Sangar Safi joined us to answer questions on cybersecurity for school leaders. So many important elements of cybersecurity were discussed, including safeguarding student data, attack prevention, data encryption, user behavior monitoring, and cyberattack response plans. You can watch more videos like these on our YouTube channel: Grow Schools – YouTube Read Full […]

Free Download

Your Cybersecurity Guide

Mitigate the risk to your school by navigating two-factor authentication, backup data, and secure logins. Download this free guide on cybersecurity created in partnership with SoftwareMSP.

Get the Guide

Cyberattacks: Understanding the Potential Threat To Your School