The rapid evolution of emerging technologies, coupled with the strain on already-stretched teams, makes urgent action necessary

Key points:

The education sector is a high-value target in today’s threat landscape
Creating IEPs with GenAI while ensuring data privacy
It’s not business, it’s personal: Building a culture of trust to protect data
For more on student data, see eSN’s IT Leadership hub

When considering industries such as finance or healthcare, the potential for sensitive data to fall into the wrong hands is a common concern. These sectors are prime targets for cybercriminals due to the financial and personal information they store. But there is another critical area often overlooked in these discussions: education.

Our educational institutions, from elementary schools to universities, are not immune to the growing threat of cybercrime. They gather a lot of personally identifiable information (PII) such as contact details, health data, and Social Security numbers. For many K–12 students, this represents an early introduction to the risks of digital data collection–and, unfortunately, cybercrime. Schools across the U.S. are already seeing an uptick in cyber threats, making it clear that protecting student data should be a top priority.

Identity theft begins before graduation

The frequency of data breaches in the education sector surged in 2023, compromising the private information of students, parents, and educators. This highlights a significant vulnerability: While schools increasingly rely on digital tools and platforms to enhance learning, many lack robust cybersecurity measures to safeguard sensitive data.

Parents provide schools with sensitive information about their children at the start of each school year, such as immunization records and medical histories. This creates an opportunity for cybercriminals to exploit students’ personal data. For instance, in 2023, the MOVEit ransomware attack affected over 800 educational organizations, compromising the personal information of nearly 1.7 million individuals. Children are particularly vulnerable to identity theft because they rarely monitor their credit, making them prime targets for long-term fraud.

According to a report from Sophos, 80 percent of K–12 schools and 79 percent of higher education institutions in the U.S. were hit by ransomware attacks in 2022–a sharp increase from previous years. These incidents highlight the growing threat to educational institutions, where cyberattacks often exploit system vulnerabilities, putting student and staff data at serious risk.

Misunderstanding cybercrime motivations

Despite the alarming rise in attacks, many have grown worryingly apathetic. Social media is flooded with comments like, “When will hackers pay off my debts since they’re already in the system?”–a sentiment that reflects the growing indifference toward the constant threat of cybercrime.

This attitude stems from a misunderstanding of cybercriminals’ motives. It is crucial to remember that hackers and ransomware attackers are not pranksters–they are financially driven opportunists who aim to exploit vulnerabilities, steal data, and hold systems for ransom. This knowledge should fuel our vigilance and caution in the face of cyber threats.

Historically, education was not a prime target, but that has changed. Cybercriminals are increasingly focusing on schools and universities as lucrative targets. As this threat grows, securing data in educational institutions must become a higher priority.

Steps to prevent data theft in education

Weak cybersecurity measures have made educational institutions attractive targets for cybercriminals. Data from the 2024 Sophos State of Education report revealed that 85 percent of ransomware attacks on K-12 schools and 77 percent on higher education institutions involved data encryption. The financial toll has been significant, with the cost of recovering from attacks doubling for K-12 schools and quadrupling for universities.

A key issue is that educational institutions often disclose data breaches slowly. For instance, only 29% of K–12 schools publicly disclose cyberattacks, though the actual number of incidents is likely higher. This lack of transparency increases risks significantly, as individuals may remain unaware their personal information has been compromised for an extended period, making it harder to prevent further misuse of stolen data.

Cybercriminals continue to target educational institutions, and current security protocols are insufficient. While perfect security may be impossible, schools can take steps to improve data protection.

Prioritizing data protection in education

To better defend against cyber threats, the education sector must prioritize investing in comprehensive data protection solutions. Encryption and tokenization are two powerful techniques that can help shield student and teacher data by making it useless without proper decryption keys. Even if attackers breach a system, encrypted data remains inaccessible.

Schools must also adopt transparent cybersecurity policies. It is crucial to work with external vendors to ensure all digital tools and platforms meet strict security standards. Additionally, promoting cybersecurity awareness among parents, educators, and students can reduce the risk of human error, such as falling for phishing scams.

Conclusion

While the education sector is often overlooked in discussions about data security, it is undeniably a high-value target in today’s threat landscape. Protecting all data is important, but safeguarding the personal information of young students is especially critical. By investing in the right data protection technologies and fostering a culture of cybersecurity, schools can improve their defenses and protect the futures of both students and educators.

Now is the time to act before cybercriminals strike with even greater force. The security of our children and teachers depends on it.

Al Kingsley MBE

Privacy and data protection are driving edtech adoption trends - eSchool News Guides