More than half of schools suffered a cyber incident in the past year, report finds

A significant number of schools have suffered at least one cybersecurity incident during the past year, according to a report released last week.

The Center for Internet Security, the Multi-State Information Sharing and Analysis Center and the Consortium for School Networking found that 51% of surveyed schools and school districts reported an incident, with 34% saying that a cyber incident interrupted or disrupted school operations. CIS found that more than 11,600 cyber incidents needed escalation and response during the 2025-26 school year. Nearly 80% of schools said they need extra support, resources or guidance on cybersecurity, especially as those attacks impact their entire school community.

The report comes as concerns continue to mount around the cybersecurity posture of schools and other educational institutions. Previous research has suggested that parents think their schools’ cybersecurity is stronger than it really is, but systems large and small — as well as third-party vendors — have suffered in the face of cyberattacks and ransomware.

"I think most school districts are prepared to deal with just about any type of incident they may face, from weather events to pandemics to acts of violence," Michael Patton, superintendent of schools for the Saratoga Springs City School District in New York, said in a statement released by CIS. "But when it comes to a major cyber event, I worry that most of us are not well prepared."

One of the report’s findings is that schools are increasingly on the “digital frontlines” of cybersecurity, trying to defend themselves against threats from nation-states and other sophisticated hackers with limited resources. The Federal Communications Commission looked to add federal heft to help deal with that issue in 2024 with a three-year, $200 million pilot program to strengthen cyber protections.

But the cyberattacks against schools often target people, which are still seen as the most vulnerable part of an attack surface. Eighty-seven percent of those surveyed said phishing attacks are among their most common cyber incidents, the report said, while that same number said susceptibility to those kinds of threats is the biggest human-related risk.

"Whether it's spear phishing, phone calls, or mass emails, humans are curious and I believe want to help by nature,” Roy Park, director of cybersecurity and digital privacy for the San Joaquin County, California Office of Education said in a statement released by CIS. “Criminals are criminals and usually will take the path of least resistance and prey on emotions. We know that a single compromised account is all it takes to advance toward a more lucrative target."

Experts said that identity has become the “new security perimeter,” meaning that hackers are generally trying to get in by using stolen credentials. To combat that, 83% of those surveyed said they have implemented multifactor authentication, although credential theft remains a big problem. MS-ISAC said it notified 808 K-12 organizations about compromised accounts, or that credentials had been found on the dark web or in other illicit marketplaces.

Adding to the cyber concerns, artificial intelligence’s use is widespread across K-12 schools, yet only one third reported having formal policies in place governing that use. And many schools remain unprepared: 70% said they use network monitoring and 59% said they have an incident response plan, but just 15% said they regularly use that plan in an exercise while only 9% reported a fully implemented cybersecurity strategy.

"We have a nearly impossible task — protecting our environments from unknown threats that only need to succeed once to create a major incident,” Chris Bailey, technology director at the Edmonds, Washington School District, said in a statement released by CIS. “In addition, we have trusted partners that are equally susceptible to threats and can lead to issues that are just as significant. Most of us are doing this work with limited resources, and this has a direct impact on our success."

While the survey shows some progress has been made, the report noted that a lot of work lies ahead if schools are to be truly strong in the face of the multiplying cyber threats they face. The report recommended closing gaps in incident preparedness, identity protection and AI policy if schools are to protect themselves, and it called for sustainable funding models from state and local governments, more access to shared cyber services and a recognition of schools as critical community infrastructure.

“Schools are working hard every day to improve cybersecurity, often with small teams and very limited resources,” Randy Rose, vice president of security operations and intelligence at CIS, said in a statement. “But the environment around them is changing quickly, especially as AI reshapes both the opportunities and risks for the K-12 community. The schools and districts that will be best positioned for the future are those that invest in the kind of cyber resilience that ensures a cyber incident doesn't expand to a community-wide crisis.”