April 8, 2025
A Cyberattack During Critical School Moments
In a small rural district last winter, a ransomware attack struck during midterm exams. As systems went dark, the impact cascaded far beyond the school’s digital infrastructure. The cafeteria staff, unable to access their electronic systems, scrambled to feed hundreds of students who depended on school meals. Parents, many working hourly jobs, suddenly needed to find childcare when classes were canceled. The graduating senior class worried about college application deadlines as their transcripts suddenly became inaccessible.
Got your attention? Good. That’s exactly what a new report on K-12 cybersecurity from the Center for Internet Security (CIS) and the Multi-State Information Sharing & Analysis Center (MS-ISAC) was trying to do in including that eye-catching story at the start of a comprehensive report it published last month. Titled Where Education Meets Community Resistance: An 18-Month, Retrospective Study of Cyber Threat Trends and Defensive Impact in K-12 Education, it draws on data from more than 5,000 K-12 organizations showing that “cyber threat actors appear to be increasingly targeting schools during critical periods like exams, times when the pressure to maintain operations makes schools far more vulnerable to ransom demands.”
Key Findings: Threats Are Increasing
Among its many findings, the report concludes that 82% of reporting K-12 schools experienced cyber threat impacts. Among those impacts, human-targeted threats exceeded other techniques by 45%, with so-called “malvertisement” (malware-infected ads) leading all other attack methods. An analysis of more than 1 trillion logs over 18 months determined there were nearly 14,000 security events observed and over 9,300 confirmed incidents. However, the report makes clear, “Not all cyber incidents are created the same, and incidents that lead to schools needing to temporarily shut down impact more than simply the ability to access files. When cyber incidents force schools to close or limit operations, vital services disappear. The impact extends far beyond missed classes, threatening the basic support systems many families rely on.”
Two of the most vital ones are school meals and special education programs. “When payment and verification systems go down,” the report notes, “schools must choose between turning away hungry students or finding alternative ways to provide meals, all while having the same requirements of tracking the number of students who came through the line. Similarly, when special education programs and counseling services lose access to digital records and communication systems, our most vulnerable students face immediate challenges.”
People: The Weakest Link and the Strongest Defense
But just as humans are the weakest link when it comes to being victimized by cyber attacks, they’re also the most effective shields in preventing attacks. It’s all about knowledge and, especially, empowerment. In light of that, “K-12 organizations should develop environments where everyone who accesses the network — from administrators to substitute teachers — feels they are a crucial part of the security team.” They should also emphasize the outsize role that a single person can play, publicly recognize those who flag potential security issues, and “create open dialogue between IT security teams and educational staff” so they’re working together instead of siloed.
All of that echoes what Mindsight experts have said for years, including in seminars that educate school superintendents on cyber attack recovery measures. “Everyone knows why we should be secure,” says Mindsight CISO Matt Cox. Mindsight cybersecurity lead Mishaal Khan said in 2024, “But when it really happens to them, when they’re victim to a cyber attack, they quickly realize it’s not just an IT problem. It’s an everyone problem — from the Superintendent to the communications team, from finance to IT.” Put on the spot, there are so many things they don’t realize.”
But as Khan knows, and as Mindsight CISO Matt Cox has advised, it’s crucial to treat staff employees like they’re the solution rather than the problem. “They’re your first line of defense. When they’re confident and informed, they make smarter choices. Whether it’s recognizing a phishing email, avoiding sketchy Wi-Fi, or using strong passwords, trained employees are security assets.”
Building a Human-Centric Defense Strategy
In addition to “traditional awareness” where cybersecurity is concerned, the CIS/MS-ISAC report offers a variety of other helpful (and also human-centric) actions that include developing “collaborative relationships between IT security teams and educational staff,” creating “clear, accessible channels for staff to report concerns without fear of judgment or reprisal,” providing “regular feedback to staff about how their vigilance and actions have helped protect the school community,” and ensuring that “leadership actively demonstrates that security is a shared responsibility, not just an IT concern.”
Conclusion: Empowering Staff as Cyber Defenders
“This seismic shift from viewing people as liabilities to seeing them as essential defenders transforms how organizations approach security,” the report concludes. “When staff members feel valued and understand their crucial role in protecting their school community, they are more likely to become active participants in security rather than passive recipients of compliance-focused training. They develop the confidence to identify threats, the knowledge to respond effectively, and the understanding that their actions directly protect students, families, and essential services that extend far beyond the classroom.”
Download the full report here.
About Mindsight
Mindsight delivers enterprise managed services and technology solutions to the mid-market across a variety of industries including education, manufacturing, financial services, government – just to name a few. Our solution architects and engineers are 100% expert-level and work as an extension of your IT team. Mindsight is headquartered in Downers Grove, IL, a suburb of Chicago.
