K-12 cybersecurity threats and attacks persist

K-12 cybersecurity threats and attacks persist


By Kyllo Consulting

Over the past several years, it seems that K-12 school districts across the U.S. (including Minnesota) have become increasingly cognizant of and responsive to the many cybersecurity threats and attacks associated with education organizations – and, this is generally good news!

Despite this generally good news, however, now is not the time for K-12 school districts to ease off on their vigilance toward or to declare their victory from cybersecurity threat and attack actors. Remember, as IBM describes them more commonly, “hacktivists, nation-state actors, cybercriminals, thrill seekers, insider threat actors and cyberterrorists hackers” essentially never stop their cybersecurity threat and attack activities. Consequently, K-12 school districts must also not stop their cybersecurity defense and protection activities.

Whether these cybersecurity threat and attack actors are malicious or non-malicious, K-12 school districts will likely be well-served (financially, operationally, and reputationally) by continuing to be proactive and alert; ready and equipped; and reflective and resilient with respect to persistent cybersecurity threats and attacks.

Vulnerability data

Unfortunately, K-12 school districts are often considered vulnerable (or even “low-hanging cyber fruit”) by cybersecurity threat actors; thus, making them potentially more prone to attack. And, the reasons are likely at least two-fold – i.e., due to the relatively:

(1) voluminous amounts of confidential (or sensitive) information K-12 school districts maintain and generate (e.g., years of student and staff records, medical and educational files, Social Security and other numbers, financial and payroll transaction accounts, etc.); and

(2) slower investment of K-12 school districts (compared to some private industries) in more heightened cybersecurity standards (e.g., multifactor authentication requirements, incident response plan development and testing, security awareness training, etc.).

Moreover, there does not appear to be a decline in the frequency of (or exposure to) K-12 school district cybersecurity threats and attacks. For example, according to the Verizon 2023 Data Breach Investigation Report, Educational Services organizations experienced 497 incidents, 238 with confirmed data disclosures (i.e., “breaches”) (see page 54) during the period from November 1, 2021, through October 31, 2022. And, these breaches were largely (76%) due to System Intrusion (e.g., hacking), Miscellaneous Errors (e.g., mis-addressed/sent email), and Social Engineering (e.g., phishing). Fundamentally, the Verizon 2023 Data Breach Investigation Report suggests that more than one cybersecurity incident (many with a confirmed data breach) involving an education organization may now be occurring in the U.S. every day.

Taking action

There are many actions K-12 school districts might consider to help reduce (if not eliminate) cybersecurity risks (and risks of loss, particularly).  While by no means an exhaustive list, consider the following:

In summary

Like many other aspects of Minnesota’s K-12 school districts, the cybersecurity risk environment continues to evolve. Through the commitment of the MSBA Insurance Trust – and its many supportive, education-specialized providers – responsive options and solutions continue to emerge to help cost-effectively address the changing cybersecurity landscape.

For more risk management information or resources, visit the MSBA Insurance Trust website or contact Tiffany Gustin at tgustin@mnmsba.org.

Share this post

Start typing and press Enter to search

Shopping Cart