Most K-12 Districts Had a Cyber Incident This Year, and Two-Thirds Defend With One or Two People

Most K-12 schools and districts in the United States had a cybersecurity incident in the past year, and most of them are defending student data with one or two people. That is the picture from a new survey by the Center for Internet Security (CIS), the Multi-State Information Sharing and Analysis Center (MS-ISAC) and the Consortium for School Networking (CoSN), released on October 27, 2026.

The report surveyed 426 K-12 cybersecurity and technology leaders between August and September. Its findings matter beyond school IT departments. Districts hold some of the most sensitive personal data any public body keeps about children, and the vendors that serve them, from student information systems to learning platforms, are part of the same exposure.

The numbers

According to StateScoop’s account of the report, a majority of respondents had experienced a cyber incident in the past year. Among them:

• 34% said the incident affected day-to-day school operations;
• 66% said they have only one or two dedicated cybersecurity staff members;
• 87% of all respondents named phishing or email compromise among the leading incidents affecting them;
• almost 80% said they needed more cybersecurity support, resources or guidance;
• 56% said their cybersecurity programs were underfunded; and
• 70% said budget limits had forced them to delay security projects, technology investments or hiring.

“I think most school districts are prepared to deal with just about any type of incident they may face, from weather events to pandemics to acts of violence. We’ve been training and drilling those for decades,” said Michael Patton, superintendent of the Saratoga Springs City School District in New York. “But when it comes to a major cyber event, I worry that most of us are not well prepared.”

Credentials, not exploits

The dominant attack is not exotic. Attackers increasingly go after user credentials rather than technical vulnerabilities, and the report says AI makes phishing messages and impersonation attempts more convincing. A teacher’s or administrator’s login can open the student information system, payroll or the district’s email.

“We know that a single compromised account is all it takes to advance toward a more lucrative target,” said Roy Park, director of cybersecurity and digital privacy at the San Joaquin County Office of Education in California.

The consequences spread. An incident can interrupt classes, take down student information systems, disrupt communications with families and stop payroll. Recent breaches, including the attack on PowerSchool that drew action from North Carolina and the Canvas hack, showed how one platform compromise can expose students across many districts at once.

AI adoption is outrunning policy

The survey also looked at AI. Adoption of AI tools in schools is moving faster than the policies and safeguards around them, according to the report. That creates two privacy problems. Students and staff may enter personal information into tools that have no contract with the district. And AI-generated phishing makes the most common attack harder to spot.

“Schools are working hard every day to improve cybersecurity, often with small teams and very limited resources. But the environment around them is changing quickly, especially as AI reshapes both the opportunities and risks for the K-12 community,” said Randy Rose, vice president of security operations and intelligence at CIS.

What the report recommends

The authors offer a practical list, much of which costs more in attention than in money:

1. Strengthen identity protection, multifactor authentication and email security.
2. Provide regular cybersecurity awareness training.
3. Set up incident response and recovery plans.
4. Create formal AI-use policies and assess third-party vendors.
5. Win leadership support for cybersecurity funding and staffing.
6. Use free or low-cost threat monitoring and information-sharing services, such as the MS-ISAC’s Malicious Domain Blocking and Reporting service.

That last service gives a sense of the volume. Districts using it recorded nearly 800 billion attempts to access school websites and online services, and the service blocked 3.52 billion connections to known or suspected malicious destinations, an average of more than 3.1 million per protected organization.

The privacy side of school cybersecurity

Security failures in schools quickly become privacy failures. Student records are covered by FERPA, many states have their own student privacy laws, and children’s data is treated as sensitive under most new state privacy statutes. Regulators have also gone after vendors: the FTC finalized an order against Illuminate Education over student data security failures.

For districts, and for the companies that sell to them, a few privacy steps fit naturally alongside the report’s recommendations:

• Know where student data lives. Keep an inventory of every system and vendor that holds student or staff personal data, including AI tools teachers have adopted on their own.
• Contract before connecting. Require data protection terms, breach notice timelines and deletion commitments from every vendor that receives student data.
• Minimize and delete. Old student records that are no longer needed are breach exposure with no benefit.
• Name a responsible person. A designated privacy lead, as described in our guide to a data protection officer for schools, gives incidents and vendor reviews a clear owner.

Funding is part of the story

Many of these gaps come down to money. With 70% of districts delaying projects, federal and state funding matters. States have urged Congress to renew cybersecurity grant programs that support local governments, including schools. Without that support, the burden falls on small teams already stretched thin.

How Captain Compliance can help

Captain Compliance helps schools and education technology vendors with the privacy governance that sits beside security work. Our personal data resources and data mapping tools help teams record what student and staff data they hold, where it goes and how long it stays. Our vendor assessments support third-party reviews, and our incident response workflows help organize the facts and deadlines after a breach. We are not a threat monitoring or email security service, and an assessment on file is not proof that a vendor’s controls work.

Frequently asked questions

Who produced the report?

The Center for Internet Security, the Multi-State Information Sharing and Analysis Center and the Consortium for School Networking, based on a survey of 426 K-12 cybersecurity and technology leaders.

What is the most common attack on schools?

Phishing and email compromise. 87% of respondents listed them among the leading incidents.

How many districts have dedicated security staff?

66% of districts that had an incident said they have only one or two dedicated cybersecurity staff members.

What does AI change?

It makes phishing and impersonation more convincing, and AI tools are being adopted faster than schools are writing policies for them.

What is the cheapest first step?

Phishing-resistant multifactor authentication on staff accounts, combined with regular awareness training, addresses the most common attack path.

The drill schools have not run

Superintendent Patton’s point is worth sitting with. Schools practice fire drills, lockdowns and evacuations because they know what each emergency looks like. Few have rehearsed the morning when the student information system is locked, payroll is down and parents are asking whether their children’s records are on the dark web. The report suggests that morning is now more likely than not.