If your school is in Wyoming, you might be safe—or at least a little safer—from education data breaches. Some 32 million records have been compromised in nearly 2,700 education data breaches over the last two decades, with about half of those hitting K12 institutions, according to a new analysis by Comparitech.
Wyoming is the only state not to report a K12 data breach. However, many states only passed laws requiring the reporting of cyberattacks within the last few years, Comparitech points out. Here are the top 10 states for K12 data breaches, with the number of the breaches and records affected:
- New York: 691 breaches/1 million records affected
- California: 303/3 million
- Texas: 116/2.3 million
- Massachusetts: 100/1.8 million
- Illinois: 86/725,300
- Ohio: 84/1.9 million
- Florida: 82/1.9 million
- Pennsylvania: 81/483,300
- Virginia: 70/891,000
- Indiana: 64/601,400
So far in 2023, there have been 11 separate educational data breaches, including six ransomware attacks, reported as of mid-March, a slight decline after a surge in incidents at the end of 2022. Comparitech points out that some breaches are not reported until weeks or months after they occur.
Politics, cell towers and hate speech: Why 3 more superintendents are out of a job
Two of the most common types of cyberattacks now involve ransomware that holds school networks hostage and third-party data breaches, when a vendor or other partner’s networks are infiltrated. One of the biggest cyberattacks occurred in 2021 when a data breach at Illuminate Education affected more than 600 educational institutions. That incident disproportionately impacted New York schools and is a key reason, along with its large K12 population, that it landed at No. 1 on the list above.
The 2020 Blackbaud ransomware attack also had a wide-ranging impact on educational institutions, Comparitech found.
A few of the biggest data breaches
When data breaches strike in K12, they almost always impact an entire district rather than just individual schools. Here’s Comparietch’s list of a few of the biggest attacks that have occurred over the past few years:
- 2021—Dallas ISD: 795,497 records affected. While it took the district a month to notify those affected, details later reveals that two students may have committed the breach. The attack, while apparently not malicious, exposed a huge security vulnerability within the district.
- 2019—Clark County School District (Nevada): 559,487 records were compromised in the Pearson Education data breach that hit numerous school districts.
- 2018—San Diego USD: 500,000 records affected. Hackers mounted a phishing attack to infiltrate the district’s central student database.
