Find your next job fast at the Jan. 28 Virtual Career Fair. Register now.
Special Report
School & District Management

Cyberattacks Force Schools to Bolster Online Security

By Alyson Klein — March 17, 2020 7 min read

The notification came in at 5:30 a.m. that something was wrong with the servers in the Cherry Hill School District outside Philadelphia. By 7:30, Wi-Fi was down. Email too.

Superintendent Joseph Meloche and his team later learned that a hacker had taken over their system, potentially through a phishing email. It took district officials and a slew of vendors more than two weeks to get everything back up and running, from staff email to the checkout system used in the school libraries. That meant 20-hour days, with emails flying back and forth daily from 5:30 a.m. to midnight.

And although learning was uninterrupted, the experience last fall was more than just a technical nightmare, Meloche said. The district had to explain to parents why they were unable to email their child’s teacher.

“It seemed like, ‘Wow, the district is falling apart,’ but we were actually functioning and functioning well,” said Farrah Mahan, Cherry Hill’s curriculum director. Still, the task of getting back to normal was grueling. “This was a marathon, you have to be slow and steady and pace yourself. There was a lot of conversation about self-care and making sure that we were taking some moments to be offline.”

Cherry Hill is far from alone. There have been at least 775 publicly disclosed cyber incidents nationally since 2016. That includes phishing attacks, data breaches, ransomware attacks, and denial-of-service attacks, according to the K-12 Cybersecurity Resource Center. And the number of incidents more than doubled in 2019, compared with 2018, from 122 to 348.

In fact, 2019 had the highest number of incidents since Douglas Levin, the founder and president of EdTech Strategies, began tracking the problem.

One possible explanation: School hacks are increasing because K-12 school systems are so reliant on technology and have potentially valuable data on students and employees, Levin said. “There are bad guys who are targeting [schools] because they’ve become successful,” Levin said.

He added that the coronavirus pandemic could exacerbate the problem because hackers play on people’s fears, more students could be using school-issued devices at home more often, and dealing with coronavirus-related technology needs could divert IT resources away from cybersecurity efforts.

Serious Consequences

Some systems, including Alabama’s Houston County school district, have had to close or postpone classes. The Rockville Center School District outside New York City paid hackers $100,000 to recover its data, according to local news reports. (The payment was covered by the district’s insurance policy, the local radio station reported.) Back in September, Louisiana Gov. John Bel Edwards, a Democrat, declared a statewide emergency after school systems in three parishes were hit by cyberattacks.

Districts are coping mostly with ransomware attacks, which will encrypt files in a computer and can quickly render entire systems inaccessible, and phishing attacks, which seek to steal employee credentials so that hackers can get into a computer system or steal valuable data, said Amy McLaughlin, the cybersecurity director for the Consortium for School Networking.

Numbers Show K-12 Cybersecurity Falling Behind Growing Problem

Schools are increasingly becoming the victims of cyberattacks—such as phishing, ransomware, and denial-of-service—because they are easy targets.

775 publicly disclosed cyber incidents in K-12 schools since 2016, including phishing attacks, data breaches, ransomware attacks, denial-of-service attacks, and other incidents.

The number of incidents more than doubled in 2019, from 122 the previous year to 348 .

Source: K-12 Cybersecurity Resource Center

44 percent of chief technology officers report their districts do not offer cybersecurity training for district employees

35 percent offer training to both teachers and principals

18 percent said their districts planned to add training this school year

73 percent of education technology leaders reported they were backing up all information and storing it off site in case of an attack

69 percent are encouraging staff to upgrade passwords

47 percent are increasing the use of encryption

34 percent are having cybersecurity practices audited by an outside organization

20 percent are convening a cybersecurity team

Source: Consortium for School Networking/Education Week

These tactics aren’t always sophisticated. The classic phishing attack could be an email that says something like “this is an emergency, please send all W-2 forms for current employees,” McLaughlin said. Or a hacker may try to copy the email of a district leader, say the superintendent, and ask their executive team to buy gift-certificates and send the codes to them right away.

K-12 systems make “really easy targets” because they are staffed by helpful, diligent people, and because district leaders’ schedules are a matter of public record, so it would be easy for a hacker to include seemingly relevant details in a phishing email, McLaughlin said.

‘Cybersafety’ Is Key Word

McLaughlin’s number one piece of advice for combatting those types of scams? Train staff. And she’s not talking about a quick, 15-minute annual in-service training, sandwiched between other professional development. She’d rather see “an ongoing marketing campaign” where everyone in the district reminds staff, and even students, to report phishing scams. Districts could offer a reward each month for the person who reports the most potential problems, she suggested, or have students make posters about the problem.

Staff should be encouraged to report every possible attempt. District tech leaders “would much rather spend time saying, ‘nope that’s not legit,’ than to have someone click [on a suspicious link or email] even once.”

She also suggests districts use the term “cybersafety” when discussing these issues. “When you talk about safety, people listen,” she explained. “When you talk about cybersecurity, it sounds like some nerdy, geeky thing and their eyes glaze over.”

Reporting every possible hacking attempt is advice Cherry Hill took after the hack earlier this year. After the incident, district leadership also moved email to a cloud-based system, with two-factor authentication. And officials told employees, “If you receive an email from an external person, if you don’t recognize the person or the name, don’t click on any forms,” Mahan said. “One person in a district of 11,000 could bring down our entire system. You have to be mindful of what you’re clicking on.”

But not every district trains its employees on cybersecurity. In fact, in a survey conducted by CoSn and Education Week, 44 percent of CTOs said they don’t offer such training. Another 35 percent said they offer training to both teachers and principals. And nearly 18 percent said they planned to add training this school year.

Back Up Computer Systems

Districts also need to do some technical work, including backing up their systems, and testing those backups. “A lot of ransomware attacks are successful because backups have been compromised,” McLaughlin said. Staff should make sure they are storing files in a place where it can be backed up, not directly on their laptops.

Jason Dial, the superintendent of the Ava R1 school district, in southwestern Missouri, which experienced an attack earlier this school year, seconded that advice.

“Be sure that you have quality backup solutions,” he said. “If it hasn’t happened to you yet, it’s going to happen. In order to be ready for it, you have to make sure you have prepared yourself so that you’re not down very long.” His district, he said, had recently installed backups and “didn’t lose anything” but “if it had happened to us a year ago, we would have been in a lot worse situation.”

Many districts are already working on backups, according to the CoSn/Education Week survey of 513 K-12 technology leaders in the United States Seventy-three percent of education technology leaders suggested they were backing up all information and storing it off site in case of an attack. Other popular strategies included encouraging staff to upgrade passwords (69 percent), increasing use of encryption (47 percent), having cybersecurity practices audited by an outside organization (34 percent), and convening a cybersecurity team (20 percent).

Sometimes, hackers demand a ransom for restoring a district’s data. McLaughlin’s advice: Don’t pony up. “I would certaintly recommend against paying, because it’s just like kidnapping,” she said. “People will continue to do that if they continue to get rewarded.”

Dial said that when district officials arrived at school on the day of the hack, several printers had messages on them saying “we have locked all of your data. If you would like it back, please send an email to this email address and we will send further instructions.”

But the hackers never heard from the Missouri district. “We choose not to respond to those types of threats. We knew that we had quality backup solutions off site,” Dial said.

And, in case the worst happens, McLaughlin recommends districts have a cyber security plan in place that’s been read and vetted by lawyers. Key staff should know what they need to do and what sort of information they need to have, in the event that they have to call the insurance company.

District leaders also need to make sure they have an incident response plan in the event of a cyber event—and they should practice it, just like they would a fire drill, McLaughlin said. “Having that pre-prepped is so much better than trying to build an airplane while you’re flying it,” she explained.

Another piece of wisdom from district leaders who have weathered attacks: Be sure to put some money aside in case the worst happens. Bob Blalock, the technology coordinator in Houston County, said his district might have ended up in a tight financial spot without some funding in reserves.

“We were very fortunate we had some budget for an emergency situation,” he said. “We are not an affluent school system.” (Blalock declined to say just how much the district spent rectifying the situation other than that it was “very expensive.”)

Intern Jake Maher contributed to this article.
A version of this article appeared in the March 18, 2020 edition of Education Week as Cyberattacks Forcing Schools to Bolster Security


This content is provided by our sponsor. It is not written by and does not necessarily reflect the views of Education Week's editorial staff.
School & District Management Webinar
Branding Matters. Learn From the Pros Why and How
Learn directly from the pros why K-12 branding and marketing matters, and how to do it effectively.
Content provided by EdWeek Top School Jobs
This content is provided by our sponsor. It is not written by and does not necessarily reflect the views of Education Week's editorial staff.
School & District Management Webinar
How to Make Learning More Interactive From Anywhere
Join experts from Samsung and Boxlight to learn how to make learning more interactive from anywhere.
Content provided by Samsung
Teaching Live Online Discussion A Seat at the Table With Education Week: How Educators Can Respond to a Post-Truth Era
How do educators break through the noise of disinformation to teach lessons grounded in objective truth? Join to find out.

EdWeek Top School Jobs

BASE Program Site Director
Thornton, CO, US
Adams 12 Five Star Schools
Director of Information Technology
Montpelier, Vermont
Washington Central UUSD
Great Oaks AmeriCorps Fellow August 2021 - June 2022
New York City, New York (US)
Great Oaks Charter Schools
Director of Athletics
Farmington, Connecticut
Farmington Public Schools

Read Next

School & District Management Opinion Parents Berating Teachers? Making Decisions Without the Data? Advice for Principals
A year marred by COVID-19 has created new challenges for principals. Here are some answers.
6 min read
Principal Advice SOC
Getty and Vanessa Solis/Education Week
School & District Management Student Mental Health and Learning Loss Continue to Worry Principals
Months into the pandemic, elementary principals say they still want training in crucial areas to help students who are struggling.
3 min read
Student sitting alone with empty chairs around her.
Maria Casinos/iStock/Getty
School & District Management Opinion A Road Map for Education Research in a Crisis
Here are five basic principles for a responsible and timely research agenda during the COVID-19 pandemic.
Robin J. Lake
4 min read
Two opposing sides reaching out to work together
J.R. Bee for Education Week
School & District Management 1,000 Students, No Social Distancing, and a Fight to Keep the Virus Out
A principal describes the "nightmare" job of keeping more than 1,000 people safe in the fast-moving pandemic.
4 min read
Dixie Rae Garrison, principal of West Jordan Middle School, in West Jordan, Utah.
Dixie Rae Garrison, principal of West Jordan Middle School in West Jordan, Utah, would have preferred a hybrid schedule and other social distancing measures.
Courtesy of Dixie Rae Garrison