These 5 cyber threats hurt the most, and how to protect yourself

Major corporations with highly-trained information security teams often fall prey to cyberattacks. Considering schools have less extensive cybersecurity defenses, it’s crucial for K12 tech leaders to recognize cybercriminals’ most common methods of attack.

A new Center for Internet Security study reveals that cybercriminals are experimenting with new ways of breaching K12 data, including:

• Increasing attacks on the human element (phishing and social engineering).
• Targeting critical academic periods to maximize disruption.
• Exploiting staff and students’ reliance on digital tools.

These tactics exist in many forms. In one of the most commonly used methods, ransomware, hackers lock school networks and demand payment to release access. These attacks are often used during critical periods like exam week.

Let’s take a look at the remaining four threats K12 schools face:

Malvertisement: Malicious software is disguised as seemingly harmless advertisements to infiltrate school networks and steal information.

Phishing and social engineering: Cybercriminals pose as trusted sources to trick staff into revealing login credentials.

Data breaches: Sensitive student and staff data is stolen, leading to identity theft and leaks of personal information.

Denial-of-service (DOS) attacks: Schools find themselves overwhelmed by cybercriminals, making online resources inaccessible.

These methods of attack impact more schools than you might think. In CIS’s study of more than 5,000 K12 institutions over 18 months, 82% of K12 organizations had experienced a cyber incident.

More from DA: This new FAQ answers your questions about DEI guidance

Cybersecurity recommendations

While cybersecurity measures typically focus on the technical requirements of keeping data secure, the report declares that a “human-first” approach aligns with preventative measures such as tornado or fire drills.

Here are some recommendations from CIS on creating safer schools in 2025:

• Empower the human element: Schools should ensure that everyone who accesses a school network feels like a crucial part of the security team. And while security awareness plays an important role, it should only be one piece of the larger “cultural transformation.” Leaders should also encourage collaboration between IT security teams and educational staff. Organizations build stronger security when technical controls complement and enhance human efforts.
• Strength through partnership: Partnering with organizations like CIS’ Multi-State Information Sharing and Analysis Center (MS-ISAC) multiplies the effectiveness of human and technical security measures.
• Fostering community resilience: Strong communities can help schools brace for threats. K12 leaders must intentionally seek and strengthen these relationships by sharing information with families during incidents, collaborating with local media outlets and creating clear guidelines for service continuity that empower your staff to make decisions.

For more information, read the full report here.