Special Report
School & District Management

Cyberattacks Force Schools to Bolster Online Security

By Alyson Klein — March 17, 2020 7 min read
  • Save to favorites
  • Print

The notification came in at 5:30 a.m. that something was wrong with the servers in the Cherry Hill School District outside Philadelphia. By 7:30, Wi-Fi was down. Email too.

Superintendent Joseph Meloche and his team later learned that a hacker had taken over their system, potentially through a phishing email. It took district officials and a slew of vendors more than two weeks to get everything back up and running, from staff email to the checkout system used in the school libraries. That meant 20-hour days, with emails flying back and forth daily from 5:30 a.m. to midnight.

And although learning was uninterrupted, the experience last fall was more than just a technical nightmare, Meloche said. The district had to explain to parents why they were unable to email their child’s teacher.

“It seemed like, ‘Wow, the district is falling apart,’ but we were actually functioning and functioning well,” said Farrah Mahan, Cherry Hill’s curriculum director. Still, the task of getting back to normal was grueling. “This was a marathon, you have to be slow and steady and pace yourself. There was a lot of conversation about self-care and making sure that we were taking some moments to be offline.”

Cherry Hill is far from alone. There have been at least 775 publicly disclosed cyber incidents nationally since 2016. That includes phishing attacks, data breaches, ransomware attacks, and denial-of-service attacks, according to the K-12 Cybersecurity Resource Center. And the number of incidents more than doubled in 2019, compared with 2018, from 122 to 348.

In fact, 2019 had the highest number of incidents since Douglas Levin, the founder and president of EdTech Strategies, began tracking the problem.

One possible explanation: School hacks are increasing because K-12 school systems are so reliant on technology and have potentially valuable data on students and employees, Levin said. “There are bad guys who are targeting [schools] because they’ve become successful,” Levin said.

He added that the coronavirus pandemic could exacerbate the problem because hackers play on people’s fears, more students could be using school-issued devices at home more often, and dealing with coronavirus-related technology needs could divert IT resources away from cybersecurity efforts.

Serious Consequences

Some systems, including Alabama’s Houston County school district, have had to close or postpone classes. The Rockville Center School District outside New York City paid hackers $100,000 to recover its data, according to local news reports. (The payment was covered by the district’s insurance policy, the local radio station reported.) Back in September, Louisiana Gov. John Bel Edwards, a Democrat, declared a statewide emergency after school systems in three parishes were hit by cyberattacks.

Districts are coping mostly with ransomware attacks, which will encrypt files in a computer and can quickly render entire systems inaccessible, and phishing attacks, which seek to steal employee credentials so that hackers can get into a computer system or steal valuable data, said Amy McLaughlin, the cybersecurity director for the Consortium for School Networking.

Numbers Show K-12 Cybersecurity Falling Behind Growing Problem

Schools are increasingly becoming the victims of cyberattacks—such as phishing, ransomware, and denial-of-service—because they are easy targets.

775 publicly disclosed cyber incidents in K-12 schools since 2016, including phishing attacks, data breaches, ransomware attacks, denial-of-service attacks, and other incidents.

The number of incidents more than doubled in 2019, from 122 the previous year to 348 .

Source: K-12 Cybersecurity Resource Center

44 percent of chief technology officers report their districts do not offer cybersecurity training for district employees

35 percent offer training to both teachers and principals

18 percent said their districts planned to add training this school year

73 percent of education technology leaders reported they were backing up all information and storing it off site in case of an attack

69 percent are encouraging staff to upgrade passwords

47 percent are increasing the use of encryption

34 percent are having cybersecurity practices audited by an outside organization

20 percent are convening a cybersecurity team

Source: Consortium for School Networking/Education Week

These tactics aren’t always sophisticated. The classic phishing attack could be an email that says something like “this is an emergency, please send all W-2 forms for current employees,” McLaughlin said. Or a hacker may try to copy the email of a district leader, say the superintendent, and ask their executive team to buy gift-certificates and send the codes to them right away.

K-12 systems make “really easy targets” because they are staffed by helpful, diligent people, and because district leaders’ schedules are a matter of public record, so it would be easy for a hacker to include seemingly relevant details in a phishing email, McLaughlin said.

‘Cybersafety’ Is Key Word

McLaughlin’s number one piece of advice for combatting those types of scams? Train staff. And she’s not talking about a quick, 15-minute annual in-service training, sandwiched between other professional development. She’d rather see “an ongoing marketing campaign” where everyone in the district reminds staff, and even students, to report phishing scams. Districts could offer a reward each month for the person who reports the most potential problems, she suggested, or have students make posters about the problem.

Staff should be encouraged to report every possible attempt. District tech leaders “would much rather spend time saying, ‘nope that’s not legit,’ than to have someone click [on a suspicious link or email] even once.”

She also suggests districts use the term “cybersafety” when discussing these issues. “When you talk about safety, people listen,” she explained. “When you talk about cybersecurity, it sounds like some nerdy, geeky thing and their eyes glaze over.”

Reporting every possible hacking attempt is advice Cherry Hill took after the hack earlier this year. After the incident, district leadership also moved email to a cloud-based system, with two-factor authentication. And officials told employees, “If you receive an email from an external person, if you don’t recognize the person or the name, don’t click on any forms,” Mahan said. “One person in a district of 11,000 could bring down our entire system. You have to be mindful of what you’re clicking on.”

But not every district trains its employees on cybersecurity. In fact, in a survey conducted by CoSn and Education Week, 44 percent of CTOs said they don’t offer such training. Another 35 percent said they offer training to both teachers and principals. And nearly 18 percent said they planned to add training this school year.

Back Up Computer Systems

Districts also need to do some technical work, including backing up their systems, and testing those backups. “A lot of ransomware attacks are successful because backups have been compromised,” McLaughlin said. Staff should make sure they are storing files in a place where it can be backed up, not directly on their laptops.

Jason Dial, the superintendent of the Ava R1 school district, in southwestern Missouri, which experienced an attack earlier this school year, seconded that advice.

“Be sure that you have quality backup solutions,” he said. “If it hasn’t happened to you yet, it’s going to happen. In order to be ready for it, you have to make sure you have prepared yourself so that you’re not down very long.” His district, he said, had recently installed backups and “didn’t lose anything” but “if it had happened to us a year ago, we would have been in a lot worse situation.”

Many districts are already working on backups, according to the CoSn/Education Week survey of 513 K-12 technology leaders in the United States Seventy-three percent of education technology leaders suggested they were backing up all information and storing it off site in case of an attack. Other popular strategies included encouraging staff to upgrade passwords (69 percent), increasing use of encryption (47 percent), having cybersecurity practices audited by an outside organization (34 percent), and convening a cybersecurity team (20 percent).

Sometimes, hackers demand a ransom for restoring a district’s data. McLaughlin’s advice: Don’t pony up. “I would certaintly recommend against paying, because it’s just like kidnapping,” she said. “People will continue to do that if they continue to get rewarded.”

Dial said that when district officials arrived at school on the day of the hack, several printers had messages on them saying “we have locked all of your data. If you would like it back, please send an email to this email address and we will send further instructions.”

But the hackers never heard from the Missouri district. “We choose not to respond to those types of threats. We knew that we had quality backup solutions off site,” Dial said.

And, in case the worst happens, McLaughlin recommends districts have a cyber security plan in place that’s been read and vetted by lawyers. Key staff should know what they need to do and what sort of information they need to have, in the event that they have to call the insurance company.

District leaders also need to make sure they have an incident response plan in the event of a cyber event—and they should practice it, just like they would a fire drill, McLaughlin said. “Having that pre-prepped is so much better than trying to build an airplane while you’re flying it,” she explained.

Another piece of wisdom from district leaders who have weathered attacks: Be sure to put some money aside in case the worst happens. Bob Blalock, the technology coordinator in Houston County, said his district might have ended up in a tight financial spot without some funding in reserves.

“We were very fortunate we had some budget for an emergency situation,” he said. “We are not an affluent school system.” (Blalock declined to say just how much the district spent rectifying the situation other than that it was “very expensive.”)

Intern Jake Maher contributed to this article.
A version of this article appeared in the March 18, 2020 edition of Education Week as Cyberattacks Forcing Schools to Bolster Security


Classroom Technology Webinar How Pandemic Tech Is (and Is Not) Transforming K-12 Schools
The COVID-19 pandemic—and the resulting rise in virtual learning and big investments in digital learning tools— helped educators propel their technology skills to the next level. Teachers have become more adept at using learning management
This content is provided by our sponsor. It is not written by and does not necessarily reflect the views of Education Week's editorial staff.
Student Well-Being Webinar
Building Teacher Capacity for Social-Emotional Learning
Set goals that support adult well-being and social-emotional learning: register today!

Content provided by Panorama
Jobs October 2021 Virtual Career Fair for Teachers and K-12 Staff
Find teaching jobs and other jobs in K-12 education at the EdWeek Top School Jobs virtual career fair.

EdWeek Top School Jobs

Teacher Jobs
Search over ten thousand teaching jobs nationwide — elementary, middle, high school and more.
View Jobs
Principal Jobs
Find hundreds of jobs for principals, assistant principals, and other school leadership roles.
View Jobs
Administrator Jobs
Over a thousand district-level jobs: superintendents, directors, more.
View Jobs
Support Staff Jobs
Search thousands of jobs, from paraprofessionals to counselors and more.
View Jobs

Read Next

School & District Management Staff Shortages Affect Students, Too. Here's Where Schools Are Shutting Down
A few months into the third academic year in a row disrupted by the COVID-19 pandemic, at least several dozen school buildings in numerous states have had to shut down due to inadequate staffing.
1 min read
A Brownsville Independent School District bus acts as a WI-FI hotspot for students needing to connect online for distance learning on the first day of class Tuesday, Aug. 25, 2020, in the parking lot of the Margaret M. Clark Aquatic Center in Brownsville, Texas. The bus is one of 20 hotspots throughout the city to help students have access to their online classes as part of the remote start to the school year due to COVID-19 pandemic.
Several shool buildings in different parts of the country have had to shut down in recent weeks due to a lack of available bus drivers.
Denise Cathey/The Brownsville Herald via AP
School & District Management Opinion We’re Facing a Looming Crisis of Principal Burnout
Caught in the crosshairs of a pandemic and rancorous partisan battles, many principals have never been more exhausted.
David E. DeMatthews
4 min read
Conceptual Illustration of burnt-out leader.
Vanessa Solis/Education Week and Getty
School & District Management What Teachers Value Most in Their Principals
For National Principals Month, we asked teachers what they love most about their principals. Here's what they had to say.
Hayley Hardison
1 min read
Illustration of job candidate and check list.
School & District Management How Staff Shortages Are Crushing Schools
Teachers are sacrificing their planning periods, students are arriving hours late, meals are out of whack, and patience is running thin.
11 min read
Stephanie LeBlanc, instructional strategist at Greeley Middle School in Cumberland Center, Maine.
Stephanie LeBlanc, an instructional strategist at Greely Middle School in Cumberland Center, Maine, has picked up numerous additional duties to help cover for staffing shortages at the school.
Ryan David Brown for Education Week