A staff login lifted from one school district rarely stops there. MS-ISAC warned 808 of its 6,116 K-12 members last school year that their people’s accounts were for sale on underground and dark web markets, and thieves use them to reach a neighboring system.
CIS, which operates MS-ISAC, calls the tactic account takeover hopping, and it works like a human chain. One district mailbox gets compromised, and everyone in its contact list gets phishing from a sender filters already trust, staff at other districts included. The mail leaves a real inbox over authenticated paths, so screening barely bites. CIS expects more of the same this school year, and hijacked K-12 mailboxes have also been used to impersonate superintendents in frauds.
Security staffing is thin. One or two people cover it in two thirds of the 426 practitioners surveyed in August and September, 11% have nobody assigned, and budget limits pushed projects or hiring off schedule for 70% of districts.
Malware arrives just as plainly: 1,159 of 1,796 infections across the ten families most often seen at member schools, about 65%, trace to malicious ads on legitimate sites, and 285 more involved ClickFix lures that talk people into running hostile commands.
Analysts counted 2,707 cases where hostile activity reached a school-managed machine, and 1,711 of those, roughly 63%, show an intruder covering tracks, with tool tampering in 881.
MFA runs at 83% of districts and email filtering at the same rate, yet only 59% keep an incident response plan, 15% rehearse it and 9% call their strategy finished. Half weathered an incident in the past year, 22% lost classroom time and 2% closed schools.
CIS urges leaders to widen MFA, watch leaked credentials, review privileged accounts and rehearse a tabletop and a live exercise yearly with leadership present.
