A new CIS and CoSN report finds over half of K-12 organizations faced a cyber incident, with phishing the top threat. Here are the findings, the caveats, and a practical readiness plan.

More Than Half of Schools and Districts Faced a Cyber Incident This Year, and the Strongest Defense Starts With People Before Software

A new report from the Center for Internet Security and CoSN draws on 426 K-12 technology leaders and more than 11,600 escalated incidents. Its clearest finding is also its most encouraging: the fixes that work are mostly habits.

Key Takeaways

•  A report led by the Center for Internet Security, which runs MS-ISAC, with the Consortium for School Networking, covered by K-12 Dive on October 27, found slightly over half of schools and districts faced a cybersecurity incident in the past year and about one-third had an incident that affected operations.

•  Phishing and email compromise were among the top incidents for 87 percent of K-12 leaders surveyed, and 83 percent said they use multi-factor authentication. The report's central line: the most targeted system in K-12 today is the human.

•  The report combined MS-ISAC service data, which logged more than 11,600 incidents needing response across 1,764 K-12 organizations in 2025-26, with a survey of 426 technology and cybersecurity leaders.

•  Budgets are the constraint: 56 percent said their programs are underfunded and 70 percent said budget problems forced them to delay projects, tools, or staffing, which makes low-cost habits the best place to start.

What the Report Found

Every district runs on email, accounts, and data, which means every district has a cybersecurity story, whether it knows it or not. A new report led by the Center for Internet Security, the nonprofit that operates the Multi-State Information Sharing and Analysis Center, known as MS-ISAC, and produced with the Consortium for School Networking, puts numbers on that story. K-12 Dive's Anna Merod covered it on October 27.

The headline is simple. Slightly over half of schools and districts faced a cybersecurity incident in the past year, and about one-third reported an incident that affected school operations. During the 2025-26 school year, the MS-ISAC service logged more than 11,600 incidents needing escalation or response across 1,764 K-12 organizations. And 13 percent of schools or districts receiving MS-ISAC monitoring experienced a credential compromise or exposure.

How the Data Was Gathered

The report draws on two sources: MS-ISAC data from K-12 organizations that use its services, and a survey of 426 K-12 cybersecurity and technology leaders, conducted in August and September. Both have limits worth stating plainly. The MS-ISAC figures cover only organizations that use its services, and a survey of 426 leaders may not represent every district in the country. The article does not discuss these limits and gives no incident cost figures. The numbers are best read as a strong signal of patterns, not a precise national count.

Phishing Is Still the Front Door

Eighty-seven percent of K-12 leaders said phishing or email compromises were among the top incidents affecting their schools. That fits what most technology directors would tell you over coffee: the easiest way into a district is not a clever exploit but a convincing email to a busy employee. A message that looks like it came from a payroll office, a vendor, or a principal can lead to a stolen password, and a stolen password can lead to access to student records.

The encouraging counterpoint is that 83 percent of leaders said they use multi-factor authentication. That is a high share, and it shows that districts have already adopted one of the most effective protections available. The report emphasizes phishing-resistant multi-factor authentication, which goes beyond codes sent by text message, and ongoing security awareness training. It states that the most targeted system in K-12 today is the human.

A Culture, Not Just a Control

The phrase about the human system has a hopeful reading. If people are the target, people are also the defense. Staff who know what a suspicious message looks like, who feel comfortable reporting a mistake quickly, and who treat security as part of the job will stop many incidents before they start. That is a cultural achievement, not a technical one, and it is within reach of every district regardless of size.

The Vendor Question

The report also highlights third-party risk. Citing a Moody's report from October, K-12 Dive notes that 57 percent of education-sector debt issuers surveyed reported a third-party cyber incident since 2020, versus 40 percent across all industries. Across all sectors, third-party incidents rose from 19 percent to 39 percent between 2020 and 2025. The article cites the 2024 PowerSchool ransomware attack and the 2026 Instructure Canvas breach as examples of incidents that exposed sensitive data of millions of teachers and students.

The practical lesson is not to avoid vendors, which no district can do, but to manage them. A district that keeps an inventory of the tools that touch student data, asks vendors how they protect it, and has a plan for what happens if a vendor is compromised is far better prepared. Companies that sell to schools should expect these questions and welcome them. Clear answers about data handling, incident notification, and access controls are becoming part of the sales process.

Artificial Intelligence Raises the Stakes

The report warns that schools without clear guardrails for AI may expose sensitive information, adopt unapproved tools, and become more vulnerable to AI-enabled phishing and impersonation. Messages that once contained telltale typos can now read cleanly. Voices and writing styles can be imitated. That makes written guidance on approved tools and data rules more important, a point we raised in our look at educators using AI at work. A one-page policy that says which tools are approved, what data may never be entered, and who to ask is a low-cost step with real value.

The Budget Gap

Resources are the hardest part. In the CIS and MS-ISAC survey, 56 percent said their cybersecurity programs were underfunded, and 70 percent said budget problems forced them to delay cybersecurity projects, technology investments, or staffing. A small district may have one person handling networks, devices, help desk requests, and security. A large one may have a team but face a longer list of systems.

That is why the habits matter. Awareness training, strong authentication, and an incident plan cost far less than a new platform, and they address the most common route of attack. District leaders can use the report to make the case for a modest, protected line in the budget, framed as insurance against disruption to instruction.

A Readiness Plan for the Next 30 Days

Districts that want to act can follow a short sequence. In week one, confirm that every staff account uses multi-factor authentication and identify the accounts that do not, starting with administrators, finance, human resources, and anyone with access to student records. In week two, run a short phishing awareness session for all staff and give them a simple way to report suspicious messages. In week three, list the vendors that hold student data and note who owns each relationship. In week four, review the incident response plan, confirm who calls whom, and hold a short tabletop exercise with the superintendent, the technology director, the business office, and communications staff.

Who Needs to Be Involved

Cybersecurity is a shared responsibility. The chief technology officer, the director of technology, the director of information technology, and any cybersecurity coordinator carry the technical load. The chief information officer sets strategy in larger systems. The school business official manages budgets, insurance, and vendor contracts. The superintendent decides priorities and speaks to the community if something goes wrong, and school board members approve funding and policy.

For a deeper look at who sits where, see our guide to the 25 K-12 decision-maker job titles every education marketer should know.

Questions Boards Will Ask

Board members who read about the report will have sensible questions. How many of our accounts use multi-factor authentication? When did we last train staff on phishing? Which vendors hold student data, and how do we know they protect it? Do we have an incident plan, and have we tested it? What do we spend on security, and what have we delayed? A superintendent who can answer with current numbers shows the board that the district is managing risk, not hoping.

What a Good Incident Plan Contains

An incident plan does not need to be long. The best ones fit on a few pages and answer a handful of questions clearly. Who is in charge when something happens? Who decides whether to take systems offline? Who calls the insurance carrier, the state agency, and law enforcement? Who tells staff, families, and the media, and in what order? Where are the backups, and when were they last tested? Districts that have written these answers down, and that have walked through them once with the whole team, respond faster and with less confusion.

The tabletop exercise is the most underrated step. A one-hour conversation around a made-up scenario, such as a compromised principal email account on the first day of testing, reveals gaps that no document will. It also gives the superintendent, the business office, and communications staff a chance to learn what the technology team needs from them.

Helping Staff Become the First Line of Defense

Training works best when it is short, frequent, and respectful. Staff are busy, and long annual modules are quickly forgotten. A five-minute example each month, a simulated phishing message followed by a friendly explanation, and a one-click button to report anything suspicious build good habits without blame. Districts that celebrate people who report mistakes quickly, instead of punishing them, tend to hear about problems sooner.

Students are part of the picture too. Older students use school accounts, and many are targets of the same kinds of messages. A short lesson on spotting suspicious links and protecting passwords can double as digital citizenship instruction.

Finally, remember the value of sharing. MS-ISAC membership, state technology offices, and peer districts all offer alerts, templates, and advice at little or no cost. A technology director who joins a regional group and swaps phishing examples with colleagues learns faster than one working alone.

Signals to Watch

Several developments are worth following: whether more districts adopt phishing-resistant authentication, how states and federal agencies support K-12 cybersecurity funding, whether vendors publish clearer data-protection commitments, how AI-enabled phishing evolves, and whether future reports include incident cost data. Each will show whether districts are closing the gap between awareness and action.

What Vendors Should Take From This

Companies that serve schools have a role in the solution. Security awareness training providers, identity and authentication tools, email filtering services, backup providers, and cyber insurance advisors all connect to what district leaders told researchers they need. The strongest offers are simple, priced for small teams, and honest about what they do and do not cover. Reaching the right decision makers early, before budgets are set, makes a difference.

If you want to reach the people who carry these responsibilities, K12 Data can help. Our school district email lists and K-12 database give you education contact data for every role in this story: a chief technology officer email list, a director of technology email list, a cybersecurity coordinator email list, a chief information officer email list, a director of information technology email list, a school business official email list, a superintendent email list, and a school board member email list. If you are ready to buy school email list data, or want a K-12 marketing database filtered by role, state, and district size, build a targeted list here while districts are planning next year's technology budgets.

Frequently Asked Questions

How common are cyberattacks on schools?

A report from the Center for Internet Security and CoSN, covered by K-12 Dive on October 27, found slightly over half of schools and districts faced a cybersecurity incident in the past year, and about one-third had an incident that affected operations.

How can schools protect against phishing?

The report emphasizes ongoing security awareness training, phishing-resistant multi-factor authentication, and a culture where staff report suspicious messages quickly. It found 87 percent of leaders cite phishing or email compromise among their top incidents.

Who is responsible for cybersecurity in a school district?

Technology leaders such as the chief technology officer, director of technology, and cybersecurity coordinator carry the technical work, while the superintendent, school business official, and school board members set priorities, budgets, and policy.