This story was originally published on K-12 Dive. To receive daily news and insights, subscribe to our free dailyK-12 Dive newsletter.
Dive Brief:
-
Slightly over half of schools or districts said they grappled with a <a href="https://bitcomme.com/canadians-confident-they-can-spot-scams-but-cybersecurity-habits-tell-a-different-story/” title=”Canadians Confident They Can Spot Scams, but Cybersecurity Habits Tell a Different Story”>cybersecurity incident in the last year, and about a third reported a cyber incident that impacted school operations, according to a report released Tuesday and led by the Center for Internet Security, a nonprofit that runs the Multi-State Information Sharing & Analysis Center.
-
Stealing credentials is becoming an increasingly common tactic among cyber criminals, the report said, with 87% of K-12 leaders reporting that phishing or email compromises are among the top cyber incidents impacting their schools and districts.
-
However, CIS and MS-ISAC said they found a bright spot: A majority of schools and districts — 83% — reported they implement multi-factor authentication.
Dive Insight:
Some schools tap MS-ISAC for free cybersecurity services including threat intelligence and incident response. During the 2025-26 school year, over 11,600 K-12 cybersecurity incidents needed escalation and response among the 1,764 K-12 organizations using one or more of MS-ISAC’s services.
On top of that, 13% of schools or districts receiving MS-ISAC monitoring services experienced a credential compromise or exposure, according to the CIS and MS-ISAC report.
“Building resilience requires not only strong security tools but also ongoing awareness, phishing-resistant multi-factor authentication, and a culture that empowers users as the first line of defense rather than treating them as the weakest link,” the report said. “The most targeted system in K-12 today is the human.” The report was conducted in partnership with the Consortium for School Networking.
The report relied its findings on two datasets: MS-ISAC’s K-12 users of cybersecurity services and a survey of 426 K-12 cybersecurity and tech leaders that CIS conducted between August and September.
Artificial intelligence is also adding a more complicated layer to K-12 cybersecurity, especially when it comes to risks.
“Schools without clear guardrails may expose sensitive information, introduce unapproved tools into their environments, and become more vulnerable to increasingly convincing AI-enabled phishing and impersonation attacks,” the CIS and MS-ISAC report said.
Concerns also persist that third-party software providers are leaving school systems’ data vulnerable to breaches and cyberattacks, especially as more districts embrace AI tools and cyber criminals increasingly rely on AI to find and exploit software vulnerabilities.
As school districts continue to rely on third-party online vendors, education is among the top sectors to experience a cybersecurity incident through a third party service, according to a report released by Moody’s Ratings in October.
Some 57% of Moody’s debt issuers surveyed in the education sector reported suffering a third-party cybersecurity incident since 2020 — compared to 40% reported across all industries. Healthcare and insurance were among sectors that saw slightly higher rates than education, Moody’s found.
Across all sectors, Moody’s said, third-party cyber incidents increased from 19% to 39% between 2020 and 2025. While more organizations keep expanding the number of software providers they use, it’s likely that third-party cybersecurity risks will continue to grow, Moody’s said.
Recent examples of K-12 challenges with third-party cyber incidents, Moody’s said, include several large ed tech platforms targeted by ransomware attacks, such as PowerSchool in 2024 and Instructure’s Canvas in 2026, which left millions of teacher and student sensitive data exposed nationwide.
As schools’ risk for both third-party data breaches and compromised credentials heightens, so do districts’ struggles for resources to fend against them. For instance, CIS and MS-ISAC found in their survey of K-12 cybersecurity and tech leaders that 56% reported their cybersecurity programs were underfunded and 70% said they had to delay cybersecurity projects, technology investments or staffing because of budget issues.
