Schools鈥� increasing reliance on digital technology, coupled with insufficient resources to defend their networks, has made them more vulnerable to cyberattacks.
There were 1,619 publicly disclosed cyberattacks on schools between 2016 and 2022, according to , a nonprofit focused on helping them prevent such assaults. And 80 percent of school IT professionals in a recent survey reported that they had been hit by a ransomware attack in the past year. School IT professionals were more likely than their counterparts in other industries to report that they had experienced such attacks.
These attacks are costly, not just in terms of how much money districts shell out to regain control of their network and systems but also in terms of how much learning time students lose while systems are down.
Here is a roundup of some of the most recent publicly disclosed cyberattacks on schools:
Prince George鈥檚 County Public Schools, Md.
About 4,500 users were impacted by a cyberattack on the Prince George鈥檚 County public schools that was detected on Aug. 14, . The district鈥攖he second-largest in Maryland鈥攊s working with cybersecurity experts, government officials, and law enforcement to determine the full extent of the attack. For now, it appears that the district鈥檚 main business and student-information systems were not affected. The district said it will contact those who are affected in the coming days and is requiring all users to reset their passwords.
New Haven Public Schools, Conn.
The New Haven school district in Connecticut lost more than $6 million after hackers appeared to have gained access to the email account of the district鈥檚 chief operating officer, according to . The hackers monitored the email correspondence between the COO and vendors and eventually impersonated both in order to divert district payments to its school bus contractor and a law firm to fraudulent accounts. So far, $3.6 million has been recouped.
Minneapolis Public Schools
In March, thousands of files purportedly stolen from the Minnesota district were published on the internet days after a cyber gang announced the school system had missed its deadline to pay a $1 million ransom demand. The files included campus rape cases, child-abuse inquiries, student mental health crises, and suspension reports, . The ransomware attack began in February and affected many of the district鈥檚 systems鈥攆rom the ability to log onto the internet from school buildings to badge access to building alarms.
MOVEit breach
MOVEit is a file-transfer platform used by thousands of governments, financial institutions, and other public- and private-sector organizations around the world. In May, the platform was hacked in a breach believed to have affected at least 161 U.S. schools, according to Brett Callow, a threat analyst for cybersecurity company . In the education sector, some of the MOVEit breach victims include Teachers Insurance and Annuity Association of America, Teachers Retirement System of Georgia, the , and the .
Other breaches:
- Cleveland City schools in Tennessee were targeted in a cyberattack on Aug. 15, but the district said less than 5 percent of staff devices were affected. The district said there鈥檚 no indication that student, faculty, or parent data have been compromised, .
- St. Landry Parish schools in Louisiana were hacked in late July, but it鈥檚 unclear how much and what kinds of data the hackers accessed. An from the district noted that its student- and employee-information systems were not part of the network compromised.
- In June, the student-information and payroll systems of the Lebanon school district in New Hampshire were taken offline following a cyberattack. Students weren鈥檛 able to access their final grades until July, .
