Stolen staff logins are spreading attacks between K-12 school districts
Last school year, 808 K-12 school organizations got some unwelcome news. The Multi-State Information Sharing and Analysis Center (MS-ISAC) told them their staff accounts or credentials were circulating on underground and dark web marketplaces. That’s 808 of the center’s 6,116 K-12 members, and attackers are using those logins to get in the door and then reach the next district.
In cases MS-ISAC tracked, an attacker phishes one legitimate district account, then uses it to send phishing to that account’s contacts, including staff at other districts. The messages come from real accounts over authenticated email paths, which weakens the filters schools rely on. The Center for Internet Security (CIS), which runs MS-ISAC, calls this account takeover hopping and assesses with high confidence that it will continue this school year. Attackers have also posed as superintendents from hijacked K-12 accounts to commit fraud.
Attackers start with people
“Whether it’s spear phishing, phone calls, or mass emails, humans are curious and I believe want to help by nature. Criminals are criminals and usually will take the path of least resistance and prey on emotions. We know that a single compromised account is all it takes to advance toward a more lucrative target,” said Roy Park, Director of Cybersecurity & Digital Privacy, San Joaquin County Office of Education (CA).
Malware also reaches staff through the browser. Of 1,796 infections from the ten malware families most often seen at K-12 members, 1,159, about 65%, traced to malicious ads on legitimate websites. Analysts also logged 285 ClickFix incidents, a lure that talks users into running malicious commands themselves. Training built around suspicious messages misses a teacher who picks up malware reading the news.
One or two people per district
CIS and the MS-ISAC surveyed 426 school IT and security practitioners in August and September. Sixty-six percent have one or two people responsible for cybersecurity, and 11% have no dedicated security staff. Seventy percent delayed security projects, purchases, or hiring over budget limits. Eighty-seven percent named phishing or email compromise as their most common incident.
Ready to block, less ready to recover
Eighty-three percent of surveyed districts have deployed MFA and the same share filter email, while 59% keep an incident response plan. Fifteen percent hold regular incident response exercises, and 9% call their security strategy implemented.
MS-ISAC’s Security Operations Center analyzed 2,707 incidents in which malicious activity reached a school-managed laptop, Chromebook, desktop, or server. In 1,711 of them, about 63%, attackers tried to avoid detection, most often by disabling or modifying security tools, seen in 881 cases. A two-person team should treat a security console that goes quiet as something to check.
Fifty-one percent of surveyed districts had a cyber incident in the past 12 months. Twenty-two percent reported disrupted classroom instruction, and 2% reported school closures.
“Schools are working hard every day to improve cybersecurity, often with small teams and very limited resources. But the environment around them is changing quickly, especially as AI reshapes both the opportunities and risks for the K-12 community. The schools and districts that will be best positioned for the future are those that invest in the kind of cyber resilience that ensures a cyber incident doesn’t expand to a community-wide crisis,” said Randy Rose, VP of Security Operations and Intelligence at the Center for Internet Security.
CIS recommends that district technology leaders expand MFA, monitor for exposed credentials, review privileged accounts, and run at least one tabletop and one operational response exercise a year with leadership involved. For states, it recommends recurring funding for shared monitoring and incident response services that districts can tap.
