Mark Your Calendar

• 8/13 - Monthly Cross-Sector Threat Briefing (member-only)

• 8/25 - Disconnect/Reconnect Tabletop Exercise

• 8/26 - K12 SIX Monthly Membership Meeting (member-only)

• 9/8 - “Inside the Attacker’s Playbook: How EDR Evasion Really Works” Webinar

In the News

In Like a Lion

While most K-12 school systems are still preparing to welcome students and teachers back for the kick-off of the fall semester, threat actors aren’t waiting. School systems in California, DC, Georgia, and Tennessee, for instance, have all reported recent incidents - to say nothing of the wave after wave of email-based phishing that school communities are currentlybeingbatteredby. It is no wonder that the IRS is warning of back-to-school scams.

Schools Should Plan Now for Significant Security Changes Coming to Microsoft, Google

Microsoft is retiring SMS and voice-based multi-factor authentication (MFA) in Microsoft Entra ID and replacing it with passkeys as the default. Starting September 1, 2026, users will be prompted to register a passkey during their next MFA challenge. By October 30, 2026, IT administrators will be forced to configure a supported telecom provider through the Microsoft Security Store if they can’t get off telephony-based MFA. On February 1, 2027, Microsoft-provided SMS and voice authentication will be officially dead. “There is no opt out from this February 1 behavior,” Microsoft says, “It will be enforced for all tenants.” For its part, Google is deprecating the Google SCEP (Simple Certificate Enrollment Protocol) API at the end of 2026. After that date, Chromebooks and other ChromeOS devices will no longer be able to enroll in school-managed enterprises if they have not migrated to another solution. Plan now to avoid (potentially significant) disruptions.

K12 SIX Joins National Council of ISACs

The National Council of ISACs (NCI) has welcomed K12 SIX to its membership, formally connecting the nation's K-12 education community to the broader network of critical infrastructure threat intelligence sharing. Formed in 2003, the NCI is a cross-sector partnership of Information Sharing and Analysis Centers (ISACs) that provides a forum for sharing all-hazards threats and mitigation strategies among the ISACs, as well as with government partners. "NCI is excited to welcome its latest member, K12 SIX," said Denise Anderson, Chair of NCI. "Schools face increasingly complex cyber threats in today’s environment. The involvement of K12 SIX in NCI extends vital threat intelligence and mitigation strategies to the K-12 community while strengthening cross-sector collaboration across all of the nation's critical infrastructure sectors." To learn more, read the accompanying press release.

Practical Vendor Risk Management for Districts and Schools

While some sectors and organizations outside of K-12 education have a deep history implementing third-party/vendor risk management programs, practical guidance for school and district technology leaders about how to implement and operate a K-12 vendor risk management program has been lacking. K12 SIX is pleased to help address that guidance gap. Developed by practicing K-12 cybersecurity practitioners serving on the K12 SIX Technical Working Group, Practical Vendor Risk Management for Districts and Schools can be accessed here. Other K-12 cybersecurity guidance, including our popular K12 SIX Essential Cybersecurity Protections, can always be found here.

Members Get More

The K12 Security Information eXchange (K12 SIX) operates as the independent, non-profit information sharing and analysis center (ISAC) exclusively for the K-12 education sector. Founded in 2020, organizations eligible for membership include school districts, charter schools and charter management organizations, private/independent schools, regional education agencies, and state education agencies. K12 SIX members get more.

The Summer Cybersecurity Challenge

While students and staff look forward to summer vacation, cybercriminals view empty hallways as prime operational time. According to the 2026 Lumu Report on Cybersecurity for Education, schools are now the #1 cybercrime target in the US. The summer break creates a "perfect storm" of skeleton IT crews, reduced network monitoring, and unpatched vulnerabilities. School IT environments are uniquely complex, managing thousands of on-campus student devices alongside on-campus IoT infrastructure (like smartboards and security cameras).

Compounding this challenge, many school tech leads are actually teachers or coaches roped into the role, leaving teams understaffed. Recent high-profile breaches—such as the 2026 Canvas platform shutdown by ShinyHunters—highlight that threat actors actively exploit these exact operational gaps.

Click here to access Lumu's complete Summer Break Action Plan for Schools including tips on:

• Pre-Break Priorities: Inventory and Audit

• Summer Housekeeping: Securing the Quiet Months

• Turning Vulnerability into Advantage

Mark Your Calendar

• 6/10 - BRC Virtual Cross-Sector Summit

• 6/11 - Monthly Cross-Sector Threat Briefing(member-only)

• 6/24 - K12 SIX Monthly Membership Meeting (member-only)

• 6/24 - AI Interrupted: A Multi-Sector Tabletop Exercise

• 7/7 - “Identity Orchestration: The Missing Layer in Your District's Digital Learning Environment” webinar

In the News

Pulling Back the Curtain on the Canvas Cyber Incident

Since the lion’s share of K12 SIX’s work with our members involves handling the sensitive operational details of defending schools from active cyber threats, it remains out of the public eye. The downside: our role and the value of our work remains opaque to the wider education community. The recent Canvas LMS cyber incident, however, provides a chance for us to pull back that proverbial curtain and offer a peek into our efforts.

Strengthening K-12 Cybersecurity: Simple Steps for Safer Schools

On May 28, the Cybersecurity and Infrastructure Security Agency (CISA) School Safety Task Force held a virtual training, entitled “Strengthening K-12 Cybersecurity: Simple Steps for Safer Schools.”

K-12 Cybersecurity is a Core School Safety Issue

For years, school safety discussions focused largely on physical security — campus entrances, emergency drills and school resource officers. Today, education leaders say cybersecurity must become part of that same conversation. A single cyberattack can disrupt learning across entire districts, expose thousands of student records and interrupt operations for days or weeks. As schools continue integrating technology into nearly every aspect of instruction, cybersecurity preparedness is increasingly becoming as essential as any other infrastructure investment.

Members Get More

The K12 Security Information eXchange (K12 SIX) operates as the independent, non-profit information sharing and analysis center (ISAC) exclusively for the K-12 education sector. Founded in 2020, organizations eligible for membership include school districts, charter schools and charter management organizations, private/independent schools, regional education agencies, and state education agencies. K12 SIX members get more.

Over three weeks, starting Friday, May 1 when Instructure first disclosed it had experienced a security incident, K12 SIX and its members immediately started coordinating and taking collective action:

• K12 SIX organized and led four separate confidential member briefings to provide updates on incident developments, including—at the invitation of K12 SIX—a briefing joined by Instructure’s CISO

• K12 SIX also conducted, and confidentially shared the results of, a quick-turnaround survey of members to assess their operational status and actions taken as part of incident response

• Members submitted threat intelligence that was vetted, enhanced, anonymized, and converted into confidential alerts by K12 SIX analysts who then shared them with the wider membership

• Other members discussed developments, insights, and questions via secure, real-time chat communications channels established for this purpose

In parallel, the K12 SIX team:

• Monitored the dark web leak site operated by the threat actor

• Reviewed historical issues and public discussions raised in GitHub, and discussion forums organized around Canvas’ open-source code, as well as relevant information about the Learning Tools Interoperability (LTI) standard and security model

• Collaborated and shared threat intelligence with representatives of the community of organizations participating in the Institute for Security and Technology’s K-12 Cyber Defense Coalition, as well as with trusted security researchers and federal partners

• To ensure accuracy, responded to numerous requests for context and commentary from education and general news reporters, resulting in seven media mentions including a live TV interview with LiveNOW from FOX

While some questions remain unanswered and breach notifications remain in progress, the active cyber-attack against Instructure seems to have come to a conclusion. However, K12 SIX will continue to work with partners to monitor the dark web for leaked credentials or other personally identifiable information associated with the incident, as well as the results of both regulatory and legal challenges stemming from the incident.

When we at K12 SIX say ‘members get more’ this is what we mean. The guidance and resources on our public-facing website represent only a small portion of the work we do. The real work is side-by-side with our member community, day in and day out.

K12 SIX was founded out of the belief that schools both needed and deserved a trusted cybersecurity partner—one that was laser-focused on the unique needs and context of the K-12 education community. We invite eligible education organizations to join us in our work. We are stronger when we work together.

Mark Your Calendar

• 5/18 - “Instructure: Technical Deep Dive on Recent Security Incident” (intended for customers)

• 5/21 - “When the Screens Go Dark:” K-12 Cybersecurity Virtual TableTop Exercise (member-only)

• 5/27 - K12 SIX Monthly Membership Meeting (member-only)

On the Soapbox

Reflecting on a Decade of K-12 Cyber Incidents

On May 18, 2016 - exactly a decade ago to the day - the U.S. Senate Committee on the Judiciary, Subcommittee on Crime and Terrorism held a hearing entitled, “Ransomware: Understanding the Threat and Exploring Solutions.” Charles Hucks, Executive Director of Technology, Horry County Schools provided testimony and answered questions regarding the recent ransomware attack against the South Carolina school district.

Much has changed in education, technology, and cyber crime since that time. Schools use more technology than ever - for teaching and learning, but also for administration and operations. The software schools rely on is no longer run in school-managed data centers, but as vendor-managed SaaS applications in ‘the cloud.’ Threat actors often exfiltrate terabytes of sensitive data in lieu of encrypting it - with extortion demands now reaching seven figures or more. And, while school systems still fall prey to ransomware attacks, threat actors are moving upstream to focus on bigger fish: education vendors, such as Instructure, PowerSchool, and Illuminate.

One is left to wonder:

• Are students and families safer and more secure today than a decade ago?

• Is the technology used in education safer and more secure? Does it respect the privacy and agency of children and youth? Is it free from vulnerabilities and exploits?

• Have schools - and their vendors and partners - allocated sufficient resources and attention to cybersecurity?

• Is the sector more resilient today to cybersecurity incidents than a decade ago?

• Has the response from education leaders and policymakers been sufficient?

Nothing that has occured over the last decade was unpredictable. We can enumerate the problems and issues. Only by working together can we hope to make a meaningful change. Let us not miss the moment to act.

Members Get More

The K12 Security Information eXchange (K12 SIX) operates as the independent, non-profit information sharing and analysis center (ISAC) exclusively for the K-12 education sector. Founded in 2020, organizations eligible for membership include school districts, charter schools and charter management organizations, private/independent schools, regional education agencies, and state education agencies. K12 SIX members get more.

One of the first questions a school district asks when considering Microsoft Sentinel is: “What will this actually cost us?"

Many Microsoft customers and partners today estimate Sentinel costs using the Azure Pricing Calculator, but that calculator doesn't provide the Sentinel-specific usage guidance needed to understand how each Sentinel meter contributes to overall spend. For K‑12 education, where budgets are fixed, IT teams are stretched thin, and adoption is necessarily phased, that kind of uncertainty can slow deployment or derail a pilot entirely. 

The “From Guesswork to Guardrails: How K‑12 Schools Can Predict and Control Microsoft Sentinel Costs” white paper presents a practical, end-to-end approach for K‑12 districts to predict, control, and manage Microsoft Sentinel costs from pilot through full production. It covers the new Sentinel Cost Estimator, the role of data ingestion as the dominant cost driver, phased deployment strategy, Azure budget alerts and automation, ingestion monitoring, and the careful use of Log Analytics daily caps. 

Mark Your Calendar

• 5/4 - K12 SIX Essential Cybersecurity Protections Workshop (member-only)

• 5/5 - “Leveraging Defender XDR & Sentinel Automations” webinar (sponsored by Microsoft) | Free and open to the K-12 community

• 5/14 - Monthly Cross-Sector Threat Briefing (member-only)

• 5/21 - “When the Screens Go Dark:” K-12 Cybersecurity Virtual TableTop Exercise (member-only)

In the News

EdTech Companies - Like Most Small/Medium Businesses - Under Frequent Cyber Attack

Small and medium businesses - including the majority of U.S. K-12 education software businesses - are frequent cybersecurity targets: 59 percent of small and medium businesses experienced a cyber attack in the last year, according to one insurance company’s research. Yet, for many, the reaction to a K-12 vendor experiencing a cyber attack is one of shock and surprise. In the last several months, we’ve seen new reports of incidents affecting: Navigate360 (ongoing), LINQ, Infinite Campus, Instructure (again, ongoing), McGraw Hill, Follet (ongoing), PowerSchool (largely missed, given the prior well-publicized incident), Kaplan, and UStrive, among others. We’ve also seen settlements with regulators (Illuminate) and ongoing court cases (Bain/PowerSchool) that, while likely to shape market behavior, won’t do enough in and of themselves to stem the tide. Clever’s most recent K-12 cybersecurity report highlighted the surge in K-12 vendor incidents, writing: “For cybersecurity measures to be most effective, districts and vendors will have to work together.” Indeed, if we make that mental shift from being surprised by an edtech vendor incident to instead expecting that they are likely to occur - because that is what evidence shows - what else may need to change?

Student Credentials Deserve Protection, Too

Who cares about Johnny’s grades or homework assignments, you may wonder? Probably not many people - and certainly not most threat actors. Instead, they have other uses they can put that access to, as several Connecticut communities have recently learned. State and local police in and around Putnam have been investigating a string of threats against local schools, many of which officials say are likely linked to compromised student email accounts and scam-related activity originating from foreign domains. One has to imagine that local law enforcement - having to spend time and resources in responding - would vehemently agree that stronger student account protections are warranted.

Millions Stolen from Schools Via Business Email Compromise Attacks

Two recent stories that drive home the seriousness of the issue: In Arkansas, one school system was bilked out of more than $3.2 million, while a North Dakota school system had nearly $5 million stolen. The kicker: the techniques used by threat actors to carry out these attacks are well-understood as are the ways to stop them. One spot of good news: when perpetrators are based in the U.S., law enforcement can and does act - sometimes resulting in jail time and financial penalties for the perpetrators.

Save the Date: 2027 K12 SIX Annual Conference

K12 SIX is pleased to announce that the next edition of the premier event for K-12 cybersecurity practitioners will be held from February 17-19, 2027 in Atlanta, Georgia. Mark your calendars and stay tuned for more information on speaker submissions, registration, and sponsorship opportunities.

Members Get More

The K12 Security Information eXchange (K12 SIX) operates as the independent, non-profit information sharing and analysis center (ISAC) exclusively for the K-12 education sector. Founded in 2020, organizations eligible for membership include school districts, charter schools and charter management organizations, private/independent schools, regional education agencies, and state education agencies. K12 SIX members get more.

Mark Your Calendar

• 4/21 - “Beyond the Breach: Setting a New Security Standard for Vendor Partnerships” webinar (sponsored by Clever)

• 4/22 - K12 SIX Monthly Membership Meeting (member-only)

• 5/5 - “Leveraging Defender XDR & Sentinel Automations” webinar (sponsored by Microsoft)

In the News

K12 SIX Essential Cybersecurity Protections: Updated for 2026!

Developed by K-12 IT practitioners, for K-12 IT practitioners—and aligned to cybersecurity risk management best practices—the K12 SIX Essentials series establishes baseline cybersecurity standards for U.S. school systems and provides guidance and tools to support their implementation. K12 SIX-recommended practices are designed to defend against the most common cyber threats facing school districts, including those identified by K12 SIX, the Federal Bureau of Investigation (FBI), the Cybersecurity & Infrastructure Security Agency (CISA), the U.S. Department of Education (ED), school insurance carriers, and other experts. ICYMI: a recent webinar provided an overview of the K12 SIX Essential Cybersecurity Protections and how to use them.

Spring Showers Bring K-12 Cyber Incidents

Public reports of threat actors targeting schools tend to spike at a few specific times in the school calendar. One of those coincides with Spring Break season (March/April) and - unfortunately - this year does not appear to be an exception to that larger trend. Spring Lake Park (MN) Schools recently closed for two days to respond to a alleged ransomware incident. Previously, Alamo Heights Independent School District (TX) experienced wide scale internet outages as it worked to recover from its own alleged ransomware incident. Meanwhile, the Los Angeles (CA) County Office of Education is currently investigating the possibility that bad actors gained access to the electronic tax documents of teachers and administrators after employees at schools around the county received letters indicating fraudulent tax filings had been submitted in their names. Since not every K-12 cyber incident makes the national news, some may wonder whether the sector remains at elevated risk of breaches and cyber extortion. In short, the steady drumbeat of K-12 cybersecurity incidents continues.

P3 Advertised 20+ Years and 0 Security Breaches. You Can Guess What Happened Next.

“This may be the worst breach I've ever seen involving sensitive student information, and I've seen many student-related data breaches over the past two decades,” writes the author of this must-read post. Fair warning: as an application designed to collect anonymous tips, unsurprisingly there are myriad references to abuse and assault in the stolen files (which - at least as of a few days ago - were still up for sale on cybercriminal forums). Doug Levin, Director of K12 SIX added: “Harm reduction must be the primary goal, including for those who may continue to use the system. Disclosures to school, non-profit, and government partners must be prompt and forthright, and necessary mitigations must be implemented and validated by independent experts with urgency. Nearly a month has passed since credible claims of a security incident were made about Navigate360’s anonymous tip line service. The lack of communication from the company is simply unacceptable.”

The Weakest Link in Security Isn’t Your Employees

People click links and download files. They create weak passwords and re-use or share them. Given this inevitability, perhaps the weakest link isn’t the employees’ predictable behavior but the system itself. After all, if common, well-understood employee mistakes can result in show-stopping cyber incidents perhaps our IT systems are too fragile. Food for thought.

Save the Date: 2027 K12 SIX Annual Conference

K12 SIX is pleased to announce that the next edition of the premier event for K-12 cybersecurity practitioners will be held from February 17-19, 2027 in Atlanta, Georgia. Mark your calendars and stay tuned for more information on speaker submissions, registration, and sponsorship opportunities.

Members Get More

The K12 Security Information eXchange (K12 SIX) operates as the independent, non-profit information sharing and analysis center (ISAC) exclusively for the K-12 education sector. Founded in 2020, organizations eligible for membership include school districts, charter schools and charter management organizations, private/independent schools, regional education agencies, and state education agencies. K12 SIX members get more.

Mark Your Calendar

• 4/16 - “The K12 SIX Essential Cybersecurity Protections: Cyber Defense for Every K-12 Organization” webinar

• 4/21 - “Beyond the Breach: Setting a New Security Standard for Vendor Partnerships” webinar (sponsored by Clever)

• 4/22 - K12 SIX Monthly Membership Meeting (member-only)

• 5/5 - “Leveraging Defender XDR & Sentinel Automations” webinar (sponsored by Microsoft)

In the News

Et tu, Infinite Campus?

For a sector still reeling from last year’s news about a PowerSchool student information system breach, comes a breach notification from another leading provider: Infinite Campus. While some have been quick to compare this most recent incident to PowerSchool’s December 2024 incident, it actually more closely resembles PowerSchool’s August 2025 incident, which admittedly flew under a lot of people’s radar. Both the Infinite Campus incident and the August PowerSchool incident centered on their use of a third-party application, Salesforce (which is typically used by companies in both the sales and customer support functions). Indeed, Salesforce and its customers have been the subject of sustained and targeted attacks over the last two years. The good news: data exfiltrated in these K-12 related incidents do not contain large amounts of personally identifiable information. The bad news: more to-do’s for K-12 privacy and security practitioners. In reflecting on the root cause of these incidents, one has to wonder what it will take to ensure that phishing-resistant MFA becomes the standard for ‘reasonable’ vendor cybersecurity.

Settle, Settle, Settle*

The U.S. is a litigious society, so it was only a matter of time before class action lawsuits - brought about school edtech products, but not by school systems directly - to result in settlements that nonetheless affect schools. In the last week, we’ve seen two such settlements. The first settlement involves Naviance, the popular college and career planning tool, and the second involves LINQ, which is an ERP and school lunch management application. The Q.J. v. PowerSchool Holdings LLC, et al. settlement covers students who “logged into the Naviance Platform offered by Hobsons and, later PowerSchool, at least once during the period beginning on August 18, 2021, and continuing through January 23, 2026.” The Connor Law v. EMS LINQ, LLC. settlement only covers those who were previously sent written notification by LINQ that their personal information “was potentially accessed, viewed, and/or obtained as a result of the Data Security Incident which occurred between September 12, 2023, and May 13, 2024.” (Of note, the instigating LINQ incident does not appear to have been publicly disclosed prior to this settlement.) What do these settlements have in common? Settlement administrators are reaching out to covered parties directly - including students and staff - without any prior to notification to the K-12 organizations that hold the contracts with Naviance and/or LINQ. The result: tough questions to school districts about their technology vendors (and lawsuits about which they were wholly unaware). One can only hope that class members don’t get too excited about the pennies that may come their way by opting in to these settlements.

* Courtesy of “Liar Liar” (1997), featuring Jim Carrey.

A Plea for Responsible Attribution

When school systems fall victim to cyber attacks, they would do well not to make public attribution to specific threat actors, including nation states or APTs. Why? First, attribution is notoriously hard and can invite retaliation and unwanted attention, and - second - spurious claims of attribution (for instance, during a time of heightened geopolitical conflict) can make it more difficult for those on the front lines of critical infrastructure and national security to triage and prioritize their work - especially when those claims may be magnified by the media. After all, who is more likely to be behind a recent denial-of-service attack against a school system? Iranian actors lashing out against U.S. aggression or a bored student seeking to avoid taking this year’s battery of state-mandated achievement tests?

Save the Date: 2027 K12 SIX Annual Conference

K12 SIX is pleased to announce that the next edition of the premier event for K-12 cybersecurity practitioners will be held from February 17-19, 2027 in Atlanta, Georgia. Mark your calendars and stay tuned for more information on speaker submissions, registration, and sponsorship opportunities.

Members Get More

The K12 Security Information eXchange (K12 SIX) operates as the independent, non-profit information sharing and analysis center (ISAC) exclusively for the K-12 education sector. Founded in 2020, organizations eligible for membership include school districts, charter schools and charter management organizations, private/independent schools, regional education agencies, and state education agencies. K12 SIX members get more.

Mark Your Calendar

• 3/25 - K12 SIX Monthly Membership Meeting (member-only)

• 4/9 - Monthly Cross-Sector Threat Briefing (member-only)

• 4/21 - “Beyond the Breach: Setting a New Security Standard for Vendor Partnerships” Webinar

In the News

Hacktivists Claim Breach of P3 School Security/Anonymous Tip App

In a story first reported by Mikael Thalen of Straight Arrow News (SAN), hacktivist(s) apparently stole data from P3 Global Intel, a cloud-based tip and intelligence management platform. Readers unfamiliar with P3 Global Intel may be more familiar with P3 Campus (the school-branded version of the platform) or with the parent company, Navigate360 (which offers a complete suite of integrated school safety solutions). Over 8 million records are claimed to have been exfiltrated, including tip submissions and narratives, two-way chat communications, personal identifiers (names, phone numbers, emails, addresses), and other highly sensitive data (such as Social Security numbers). Thalen writes: “Many school-related messages viewed by SAN involved highly sensitive matters, such as self-harm, suicide and threats of violence.” This one has the potential to be very bad, folks - and offers a cautionary tale about the cybersecurity practices of physical security software and device companies.

Test-Prep Provider Kaplan Breached

Three months after unauthorized access was first determined to have occurred, Kaplan is now notifying affected parties of a breach of data that may include some combination of names, social security numbers, driver’s license numbers, and more. While they also serve higher education and business customers, they are well known in K-12 for providing SAT/ACT/AP test preparation services to schools and individual students. The threat actor maintained access to Kaplan’s servers over a 3 week period between Oct 30 and Nov 18, 2025. In their (Maine) notification letter, Kaplan writes: “To help prevent a similar incident from happening again, Kaplan will continue to invest in the security of its computer systems and has implemented additional measures to further enhance the security of the Kaplan IT network.” A fine statement for what it is, but is it enough?

Conservative Parents and Teachers Unions Become Unlikely Allies Fighting Tech in Schools

The critiques of the use and adoption of technology in U.S. K-12 are myriad: consumerism/advertising, inappropriate content, online bullying and harassment, invasive monitoring, anti-intellectual distraction machines, cheating, scams, data breaches, student health/screen time - and that’s just the tip of the iceberg. Some will argue these critiques are about consumer technology or technology used by children and youth outside of school and not tools and devices designed specifically for and used in K-12 settings. Yet, that has long seemed a distinction without a difference, especially because the firewall between consumer/enterprise and education technology in schools is so weak and porous. While there has long been a counter-movement to technology in K-12, it has more recently gained momentum - and brought some unlikely parties together over shared concerns. Where this all goes is unclear (and whether any remedies may be worse than the harm), but it may presage the end of the ‘anything goes’ era of technology use in schools - and that may not be such a bad outcome.

Members Get More

The K12 Security Information eXchange (K12 SIX) operates as the independent, non-profit information sharing and analysis center (ISAC) exclusively for the K-12 education sector. Founded in 2020, organizations eligible for membership include school districts, charter schools and charter management organizations, private/independent schools, regional education agencies, and state education agencies. K12 SIX members get more.

Mark Your Calendar

• 2/12 - Monthly Cross-Sector Threat Briefing (member-only)

• 2/17 - “Securing the Future of Education: Updating the Cybersecurity Playbook” webinar (sponsored by Microsoft)

• 2/18 - K12 SIX Monthly Membership Meeting (member-only)

• 2/24 - 2/26 - 2026 National K-12 Cybersecurity Leadership Conference

2026 National K-12 Cybersecurity Leadership Conference

Hosted by the K12 Security Information eXchange (K12 SIX), the 2026 National K-12 Cybersecurity Leadership Conference is a unique event designed for all K-12 cybersecurity practitioners to identify and share solutions and best practices to better defend school communities from emerging cybersecurity threats, such as ransomware and data breaches. The fourth annual conference will be held February 24-26 in Albuquerque, New Mexico. Advance registration required.

• Preliminary agenda, updated 2/4.

• Featuring: Workshops, Tabletop exercise, Birds of a Feather networking, Peer-led educational sessions, Capture the Flag contest, Exhibit hall

• Learn from experts at the Cybersecurity & Infrastructure Security Agency (CISA/DHS) and U.S. Department of Education/Privacy Technical Assistance Center (PTAC)

• And much more

On the Soapbox

Lies, Damned Lies, and K-12 Cybersecurity Statistics

While it may defy belief by those not as close to the work, no one has comprehensive, reliable data on cybersecurity incidents at scale, including about those that impact U.S. K-12 organizations. There are several reasons for this:

• First, let us acknowledge that 1/ incident victims have every incentive to not voluntarily disclose anything and 2/ existing public reporting requirements are variable and quite weak. Absent a national, uniform public reporting requirement for cyber incidents,** no one has a comprehensive dataset upon which to base conclusions. What few reporting requirements exist vary across states by organization type, incident type, and incident severity. Plus, none of the existing requirements include much, if anything, on the subject of public disclosure. Even when invoking freedom of information requests, investigative reporters have been stymied in obtaining incident reports from state entities that are repositories for such data. Others with select insights—such as cybersecurity insurance providers—treat their knowledge as proprietary and a trade secret.

• Second, many cybersecurity incidents do not fit into neat definitions—and organizations routinely apply definitions in different ways. Case in point: a threat actor sends a phishing email to steal credentials from a K-12 administrator that are then used to exfiltrate sensitive data about the school system from the school system’s vendor. The threat actor then extorts the school system, attempting to intimidate the district to pay a ransom demand or risk the abuse of the stolen data. How would one categorize the incident? As social engineering? Yes, but not that alone. As ransomware? A ransom is being sought but no malware was deployed, and access to IT systems remains uninterrupted. Is this even an incident that one would associate with the school system or would the vendor be blamed? Unclear. The categories of incidents used in common parlance simply do not hold up to even cursory scrutiny. Every organization making statistical claims about K-12 cybersecurity applies their own methodology to source and categorize incidents, including—in some cases—by counting claims of cyber criminals as gospel fact.

• Third, cybersecurity industry reports on the ‘education sector’ take a laughably large number and type of organizations and treat them as if they are the same: universities, community colleges and trade schools, school districts (large and small), elite private schools, religious schools, and charter schools; public and private; across states, in the U.S., and abroad. What lessons could U.S. K-12 IT practitioners (or policymakers) take from a recent attack on an Italian university? They operate under different governance and legal regimes, are resourced differently, use different vendors, and serve a different population. There is precious little actionable for the K-12 practitioner here.

Spurious K-12 cybersecurity claims lead under-resourced school systems to purchase solutions mismatched to their needs and spend precious time defending against imaginary threats. They also lead policymakers to the wrong solutions, resulting in waste, fraud, and abuse of government investments. Yet, so long as news stories get clicks and cybersecurity vendors move product, here we’ll remain.

As a reader, hold those making claims to a higher standard and ask them to show their work. Look for information about what types of organizations are included and over what time frame. Look for details about how incidents are sourced, defined, and classified. If a survey was conducted, demand information about the sample and generalizability. Call BS on conference presenters repeating myths about K-12 cybersecurity trends and data—and on reporters who repeat it uncritically and without context.

** While CIRCIA is an important step forward—and K12 SIX is on record supporting the regulation’s application to the K-12 sector—it is neither designed nor intended to address the issue of research and reporting in the public domain.

Members Get More

The K12 Security Information eXchange (K12 SIX) operates as the independent, non-profit information sharing and analysis center (ISAC) exclusively for the K-12 education sector. Founded in 2020, organizations eligible for membership include school districts, charter schools and charter management organizations, private/independent schools, regional education agencies, and state education agencies. K12 SIX members get more.

Mark Your Calendar

• 1/27 - ‘Cybersecurity in the Classroom: From Reactive Recovery to Proactive Prevention’ Webinar (sponsored by Abnormal AI)

• 1/28 - K12 SIX Monthly Membership Meeting (member-only)

• 1/28 - AI Interrupted: A Multi-Sector Tabletop Exercise

2026 National K-12 Cybersecurity Leadership Conference

Hosted by the K12 Security Information eXchange (K12 SIX), the 2026 National K-12 Cybersecurity Leadership Conference is a unique event designed for all K-12 cybersecurity practitioners to identify and share solutions and best practices to better defend school communities from emerging cybersecurity threats, such as ransomware and data breaches. The fourth annual conference will be held February 24-26 in Albuquerque, New Mexico. Advance registration required.

• Preliminary agenda posted (updated 1/11).

• Featuring: Workshops, Tabletop exercise, Birds of a Feather networking, Peer-led educational sessions, Capture the Flag contest, Exhibit hall

• Learn from experts at the Cybersecurity & Infrastructure Security Agency (CISA/DHS) and U.S. Department of Education/Privacy Technical Assistance Center (PTAC)

• And much more

In the News

Florida Man Arrested for Defrauding Louisiana School District, Stealing $251k

Agents with the Louisiana Bureau of Investigation recently arrested a 58-year-old man from Florida for taking part in a November 2024 scheme to defraud the Sabine Parish School Board (LA) out of more than $250,000. As part of the scheme, a school board employee was persuaded to, unwittingly, send an ACH payment in the amount of $251,972.00 to an out of state bank account controlled by the perpetrator(s). This payment was made to a vendor, believed to be legitimate, for the purchase of metal detectors intended to be placed at Sabine Parish school campuses. The investigation is ongoing.

NJ School District Sends $178K in Payments for School Construction Project to Cyber Criminals Instead

Nearly $178,000 in payments made by Princeton Public Schools (NJ) to a vendor working on a construction project appear to have been lost in a wire fraud scam. District officials said they alerted authorities last month after they were told three payments sent to a vendor 15 months earlier were never received. Although the incident occurred in September 2024, school board members did not learn about the missing funds until roughly 15 months later, in early December 2025. While the School Board president asserted that the vendor, not the district is ultimately liable for the loss in a recent public meeting, time will tell how it gets sorted out.

Security Lapse at Online Mentoring Company Exposed Student Data

Online mentoring site UStrive has resolved a vulnerability that exposed the personal information of its users, including students. The exposed data included the full names, email addresses, phone numbers, and other non-public and user-provided information of UStrive users, which was accessible to any other logged-in user. According to reporting by TechCrunch, a vulnerable GraphQL endpoint — a type of query database interface — allowed access to reams of user data stored on UStrive’s servers. While UStrive claims “1.1 million students have opted in for a UStrive mentor,” only 238,000 user records were observed at the time of discovery.

Members Get More

The K12 Security Information eXchange (K12 SIX) operates as the independent, non-profit information sharing and analysis center (ISAC) exclusively for the K-12 education sector. Founded in 2020, organizations eligible for membership include school districts, charter schools and charter management organizations, private/independent schools, regional education agencies, and state education agencies. K12 SIX members get more.

Mark Your Calendar

~~ Happy new year! ~~

• 1/27 - ‘Cybersecurity in the Classroom: From Reactive Recovery to Proactive Prevention’ Webinar (sponsored by Abnormal AI)

• 1/28 - K12 SIX Monthly Membership Meeting (member-only)

2026 National K-12 Cybersecurity Leadership Conference

Hosted by the K12 Security Information eXchange (K12 SIX), the 2026 National K-12 Cybersecurity Leadership Conference is a unique event designed for all K-12 cybersecurity practitioners to identify and share solutions and best practices to better defend school communities from emerging cybersecurity threats, such as ransomware and data breaches. The fourth annual conference will be held February 24-26 in Albuquerque, New Mexico. Named a “top K-12 conference to attend in 2026” by K-12 Dive. Advance registration required; conference room block selling out fast.

• Preliminary agenda posted (updated 1/11).

• Featuring: Workshops, Tabletop exercise, Birds of a Feather networking, Peer-led educational sessions, Exhibit hall

• Learn from experts at the Cybersecurity & Infrastructure Security Agency (CISA/DHS) and U.S. Department of Education/Privacy Technical Assistance Center (PTAC)

• And much more

In the News

PA School District Suffers Holiday Cyber Attack, School Closures: “We hope to start 2026 more positively”

On December 15, 2025, Minersville Area School District (PA) was victimized by a cyber attack. Upon discovery of the incident, which included attempts to install malware on school system devices, the district shut down all IT systems - resulting in a four day school closure right before the holiday break. According to the Superintendent, schools were closed not only because instruction would have been affected by the loss of technology, but because the district’s computer system and the internet are also crucial to running security and communications in the buildings. In a communication to the school community, the district acknowledges the possibility of a data breach and the wisdom of implementing a credit freeze at each of the three major credit reporting bureaus.

AL School District Notifies Parents of Holiday Cyber Attack, Data Breach

Also victimized this holiday season, Pell City (AL) School System reported a recent ‘security incident’ to school community members. The Superintendent said that while the student information system did not appear to be affected, some data had been exfiltrated from district servers. Comparitech notes that the cyber criminal group SafePay did take credit for the December 2025 incident on their dark web leak site. NOTE: K12 SIX analyses identify SafePay as being the most prolific in targeting the U.S. K-12 education sector during the 2025 calendar year. For more on SafePay, see “Unmasking the SafePay Ransomware Group.”

FBI Recovers More than $300k Scammed from TN School System

About a year ago, Washington County (TN) Public Schools staff were tricked into sending a wire transfer of $335,215 to cyber criminals instead of the company the district had hired to undertake $1.5 million in security system renovations. Within three days, the error was discovered and officials were notified - and that made all the difference. A recently released financial audit (November 2025) classified the incident as a material weakness in internal controls, noting that existing policy lacked guidance to verify payment method changes and wire transfers before processing disbursements. Going forward, verbal confirmation of any bank routing changes will be made using verified vendor telephone numbers. Readers would do well to note that these type of phishing scams targeting K-12 accounts payable staff are common and have resulted in some of the largest direct financial losses attributable to cyber crime that school systems have experienced.

Members Get More

The K12 Security Information eXchange (K12 SIX) operates as the independent, non-profit information sharing and analysis center (ISAC) exclusively for the K-12 education sector. Founded in 2020, organizations eligible for membership include school districts, charter schools and charter management organizations, private/independent schools, regional education agencies, and state education agencies. K12 SIX members get more.

Mark Your Calendar

• 12/17 - K12 SIX Monthly Membership Meeting (member-only)

  ~~ Happy holidays! ~~

IL School District Closed for Three Days Due to Cybersecurity Incident

On Sunday, November 30, 2025, Zion Elementary School District 6 (IL) was impacted by a cybersecurity incident that resulted in the suspension of teaching and learning - and extracurriculars - for three days the following week. Students and teachers were welcomed back from Thanksgiving on Thursday, December 4. On its website, district leadership sought to reassure its community that the privacy and security of its students and staff remains their highest priority: “ZESD 6 has multiple safeguards in place to prevent cyberattacks on district systems, including usernames, passwords, and multi-factor authentication (MFA).”

FTC Takes Action Against Illuminate (Renaissance) for Negligent Cybersecurity Practices

Before the PowerSchool incident, there was Illuminate’s. Following on the heels of a joint settlement with three different state attorneys general (CA, CT, and NY), the federal government is now seeking to levy additional penalties against the firm, which was acquired by Renaissance on the heels of the incident. The FTC complaint details facts about the cyber incident that heretofore had not been public knowledge. For instance, the threat actor compromised still-active credentials held by an IT administrator who had left the company over three years prior. After nearly two weeks of unfettered access to Illuminate systems, the threat actor also extorted the company to prevent the release of the data they had exfiltrated and - like PowerSchool - the company paid the threat actor to delete the data. The FTC complaint is worth the read as it does a good job of debunking the company’s public claims about its privacy and security practices vs reality. Remember folks: trust and verify. Both steps are necessary, especially for your critical vendors.

Friends Don’t Let Friends Buy AI Toys for the Holidays

In news that really shouldn’t be a surprise to any of us following this more closely, it turns out that integrating AI chatbots into children’s toys is a recipe for…raised eyebrows, if not a lot more. Interested in digging deeper? Read the full report from U.S. PIRG here.

4th Annual National K-12 Cybersecurity Leadership Conference (Feb 2026)

Hosted by the K12 Security Information eXchange (K12 SIX), the 2026 National K-12 Cybersecurity Leadership Conference is a unique event designed to identify and share solutions and best practices to better defend the K-12 education sector from emerging cybersecurity threats, such as ransomware and data breaches. The fourth annual conference will be held February 24-26, 2026 in Albuquerque, New Mexico. Named a “top K-12 conference to attend in 2026” by K-12 Dive.

Members Get More

The K12 Security Information eXchange (K12 SIX) operates as the independent, non-profit information sharing and analysis center (ISAC) exclusively for the K-12 education sector. Founded in 2020, organizations eligible for membership include school districts, charter schools and charter management organizations, private/independent schools, regional education agencies, and state education agencies. K12 SIX members get more.

Mark Your Calendar

• 12/9 - AI Cyber Espionage Campaign Briefing - featuring CISO, Anthropic (member-only)

• 12/11 - Monthly Cross-Sector Threat Briefing (member-only)

• 12/17 - K12 SIX Monthly Membership Meeting (member-only)

In the News

Pre-Thanksgiving Cyber Incident Closes NC School District

Attacked over the weekend prior to Thanksgiving, Jackson County (NC) Public Schools closed their district for holiday break early to facilitate remediation and recovery. In so doing, IT staff cancelled vacations and worked overtime to shut down their entire network, including internet, Wi-Fi, phones, camera/door access systems, and all other network services. While the incident was more severe than originally believed, at this time district officials do not believe any sensitive data is at risk. Rather, they believe they were affected by a DDoS attack - for which they were not even the intended target.

US Policy Response to K-12 Cyber Incidents Lagging

While some K-12 edtech experts are downright pessimistic about the lessons we’ve learned and changes we’ve implemented to shore up K-12 cybersecurity post-PowerSchool cyber incident, strikingly our neighbors to the north are taking a different approach. Case in point: a blog post entitled “Use of edtech in schools: Children should not have to swap their privacy for an education” by Patricia Kosseim, Information and Privacy Commissioner of Ontario, which details several streams of work happening in Canada. For K-12 cybersecurity advocates, there is much to like in her description of actions and recommendations. Meanwhile, in the US, what focus there is remains on penalizing PowerSchool for yesterday’s behavior instead of taking the steps necessary to preventing future incidents. Make it make sense.

Hacking + Folklore = Hacklore (and it’s not good, folks)

Don’t believe everything you read. Turns out that a lot of cybersecurity advice being peddled to everyday users is actually…wrong. Bob Lord, who may be remembered for his time at CISA spearheading their Secure by Design initiative (alongside Lauren Zabierek and Jack Cable), is the force behind a new site, entitled ‘Stop Hacklore!’ Importantly, the site not only debunks unhelpful security advice but calls out specific security practices that actually work, like installing security patches, MFA, long passphrases, and password managers. Don’t trust, Bob? Nearly a hundred other prominent CISOs have endorsed the effort so far.

4th Annual National K-12 Cybersecurity Leadership Conference (Feb 2026)

Hosted by the K12 Security Information eXchange (K12 SIX), the 2026 National K-12 Cybersecurity Leadership Conference is a unique event designed to identify and share solutions and best practices to better defend the K-12 education sector from emerging cybersecurity threats, such as ransomware and data breaches. The fourth annual conference will be held February 24-26, 2026 in Albuquerque, New Mexico. Named a “top K-12 conference to attend in 2026” by K-12 Dive.

Members Get More

The K12 Security Information eXchange (K12 SIX) operates as the independent, non-profit information sharing and analysis center (ISAC) exclusively for the K-12 education sector. Founded in 2020, organizations eligible for membership include school districts, charter schools and charter management organizations, private/independent schools, regional education agencies, and state education agencies. K12 SIX members get more.

Mark Your Calendar

• 11/18 - From ABC to PhD: Building K-12 Cyber Defense from Kindergarten to Staff Room (sponsored by Infosec Institute)

• 11/19 - K12 SIX Monthly Membership Meeting (member-only)

In the News

VA School District Recovering from Cyber Incident that Forced Districtwide Closures

Manassas City (VA) Public Schools continue their efforts to recover from a significant cyber incident experienced on or about November 9 that disrupted internet and phone service and led to school closures across the district. (The proximity of the incident to a national holiday may have helped avoid even greater disruption.) Phone service was interrupted for about 5 days while ‘some technology tools’ may still remain offline as recovery efforts continue. The threat actor has not been publicly identified, nor has there been a confirmation of an extortion demand.

Implementing a Comprehensive K-12 Cybersecurity Cybersecurity Program: Building the Plane While Flying It

In a blog post entitled “Why Securing Things ‘Backwards’ Is So Difficult in K–12 IT,” Brad Cornell drops some wisdom on the challenges of trying to overhaul a school system’s cybersecurity posture without disrupting learning (too much). As he writes: “Transitioning from ‘anything goes’ to ‘secured by design’ is one of the hardest shifts for schools to make. Not because people don’t care about security, but because securing things backwards means undoing years of habits, expectations, and legacy decisions.” The post concludes with some good tips on tactics that can help pave the path toward greater buy-in and ultimately resilience.

Good News, Bad News: SLCGP Reauthorized in Government Funding Deal

Good news: the end of the longest federal government shutdown in history late Wednesday night also reauthorized a popular federal cybersecurity grant program for state and local governments: the State and Local Cybersecurity Grant Program (SLCGP). The bad news: the reauthorization only extends the program until January 30. What the program looks like the future - including funding levels - all remains open for debate. The National Association of State Chief Information Officers (NASCIO) response: “Congress should act swiftly to provide certainty and stability for state governments by passing a long-term extension…, combined with adequate levels of funding, that will allow stakeholders to strengthen their cyber defenses and meet the challenges of the future.”

4th Annual National K-12 Cybersecurity Leadership Conference (Feb 2026)

Hosted by the K12 Security Information eXchange (K12 SIX), the 2026 National K-12 Cybersecurity Leadership Conference is a unique event designed to identify and share solutions and best practices to better defend the K-12 education sector from emerging cybersecurity threats, such as ransomware and data breaches. The fourth annual conference will be held February 24-26, 2026 in Albuquerque, New Mexico. Named a “top K-12 conference to attend in 2026” by K-12 Dive.

Members Get More

The K12 Security Information eXchange (K12 SIX) operates as the independent, non-profit information sharing and analysis center (ISAC) exclusively for the K-12 education sector. Founded in 2020, organizations eligible for membership include school districts, charter schools and charter management organizations, private/independent schools, regional education agencies, and state education agencies. K12 SIX members get more.

Mark Your Calendar

• 11/3-5 - Cross-Sector Summit on Security & Third-Party Risk

• 11/13 - Monthly Cross-Sector Threat Briefing (member-only)

• 11/18 - From ABC to PhD: Building K-12 Cyber Defense from Kindergarten to Staff Room (sponsored by Infosec Institute)

• 11/19 - K12 SIX Monthly Membership Meeting (member-only)

In the News

Cyberattack Fallout: Lawsuit Targets South Carolina School District

A former employee and parent of students attending the Lexington-Richland School District Five (SC) has retained a California-based data-privacy law firm to file a class-action lawsuit against the district, alleging the district failed to protect sensitive student and employee data during a June 2025 ransomware attack that compromised the personal information of thousands of individuals. Investigators determined that the breach exposed personally identifiable information – including names, birthdates, employee and student records, Social Security numbers and internal financial files – impacting more than 31,000 students, parents, alumni and staff. Add this to growing list of cybersecurity-related legal cases being brought by employees, parents, and students against K-12 school systems around the country - for better and worse.

ND School System Writes Off $840,000 Loss from 2024 Phishing Scam

Despite a still ongoing investigation, the Grand Forks Public Schools officially recorded the missing funds as a loss when books were closed in June. On Sept. 13, 2024, the district first disclosed it lost $2.2 million in what was later revealed to be a phishing scam. Five months later, the school board was informed that authorities were able to recover $1,296,935 of the stolen funds. That coupled with a $100,000 payout from their insurance company reduced the total loss to $842,730. Reflecting on the incident, a district official remarked: “It’s not a matter of if it happens, it's a matter of when. You can't write off and say ‘those are the types of problems that are for big organizations.’ I think it's only a matter of time – we all are targeted individuals alike. And I think that the greatest single safeguard, in so many ways, is to slow down, be thoughtful, be very careful.”

No, AI Does Not Power 80% of Ransomware

The security community is debating new claims from MIT Sloan researchers and Safe Security this week, after a jointly authored paper asserted that 80 percent of ransomware attacks are AI-driven. The MIT paper isn’t an isolated case of fictional narratives about artificial intelligence, though. Similar claims are appearing across the security industry, often tied to surveys or marketing campaigns rather than incident data. For a more evidence-based look at AI use by threat actors, the European Union Agency for Cybersecurity (ENISA) may be the best current source. Here’s to more facts and less FUD in cybersecurity marketing.

4th Annual National K-12 Cybersecurity Leadership Conference (Feb 2026)

Hosted by the K12 Security Information eXchange (K12 SIX), the 2026 National K-12 Cybersecurity Leadership Conference is a unique event designed to identify and share solutions and best practices to better defend the K-12 education sector from emerging cybersecurity threats, such as ransomware and data breaches. The fourth annual conference will be held February 24-26, 2026 in Albuquerque, New Mexico. Named a “top K-12 conference to attend in 2026” by K-12 Dive.

Members Get More

The K12 Security Information eXchange (K12 SIX) operates as the independent, non-profit information sharing and analysis center (ISAC) exclusively for the K-12 education sector. Founded in 2020, organizations eligible for membership include school districts, charter schools and charter management organizations, private/independent schools, regional education agencies, and state education agencies. K12 SIX members get more.

Mark Your Calendar

• 10/21 - Pressure Building: Why All Districts Need a Solid Foundational Cybersecurity Program (sponsored by Identity Automation, a Jamf company)

• 10/22 - K12 SIX Monthly Membership Meeting (members-only)

• 10/28 - Passwords Must Go: The Future of Authentication in K-12 (sponsored by Clever)

• 10/31 - Deadline for submission of speaking proposals - and Early Bird Registration - for the 2026 National K-12 Cybersecurity Leadership Conference

In the News

Lessons Learned from the PowerSchool Incident

After pleading guilty to hacking and extorting from ed tech giant PowerSchool, 19-year-old Matthew Lane was recently sentenced to four years in prison and nearly $14.1 million in restitution. Although Lane has been held accountable for the PowerSchool cyberattack and sentenced to prison, “the damage is done” from the leak of the school districts’ sensitive data, Doug Levin, K12 SIX Director said. “There’s no putting the genie back in the bottle.” K-12 cybersecurity remains “an ongoing problem,” and cyberattacks against schools won’t stop just because someone was held accountable for the PowerSchool incident, Levin said.

Yet Another $1M+ Victim of a BEC Attack Targeting a School Construction Project

This one victimizing a New York school system. The frustration: this is a well-established tactic with a long history of claiming U.S. school district victims. Case in point: Here is K12 SIX Director Doug Levin expressing these same thoughts in a story about another victim in - wait for it - January of 2020. We know how to prevent these attacks, but it requires cooperation of school system finance/accounts payable offices, strong policies for verification of ACH account routing change requests, and a no-exceptions adherence to that policy.

Audit: TN Department of Education Lacks Critical Controls Over Statewide Information Systems

In an audit conducted by Tennessee Comptroller of the Treasury/Division of State Audit and published earlier this month, the Department of Education was found to lack sufficient controls for managing information systems responsible for the oversight of “billions of dollars in state and federal funds.” These information systems are integral to managing student data, allocating education funding, licensing educators, administering assessments, and supporting statewide planning and reporting. While the specific nature of the audit finding was redacted due to the sensitivity of the concern, the Department concurred with the finding: “We concur. The Department recognizes and understands the criticality of ensuring adherence to the general controls over the information systems….The Department is taking all steps to ensure the ongoing security of data and all associated systems.”

4th Annual National K-12 Cybersecurity Leadership Conference (Feb 2026): Call for Speakers, Early Bird Registration Closes 10/31 

The National K-12 Cybersecurity Leadership Conference is a unique event designed to identify and share solutions and best practices to better defend the K-12 education sector from emerging cybersecurity threats, such as ransomware and data breaches. Participants from past conferences report overwhelmingly positive feedback about the conference: “I just wanted to reach out to say thank you again for an amazing conference. My team and I all agreed that was by far one of our best conferences any of us have ever attended.” The 4th Annual conference will be held February 24-26, 2026 in Albuquerque, NM.

Members Get More

The K12 Security Information eXchange (K12 SIX) operates as the independent, non-profit information sharing and analysis center (ISAC) exclusively for the K-12 education sector. Founded in 2020, organizations eligible for membership include school districts, charter schools and charter management organizations, private/independent schools, regional education agencies, and state education agencies. K12 SIX members get more.

Mark Your Calendar

• 10/7 - Get to Know K12 SIX: Core Benefits of Membership

• 10/9 - Monthly Cross-Sector Threat Briefing (member-only)

• 10/14 - Cybersecurity Education for K-12: Putting CISA’s Guidance into Action (sponsored by Fortinet)

• 10/21 - Pressure Building: Why All Districts Need a Solid Foundational Cybersecurity Program (sponsored by Identity Automation, a Jamf company)

• 10/28 - Passwords Must Go: The Future of Authentication in K-12 (sponsored by Clever)

• 10/31 - Deadline for submission of speaking proposals for the 2026 National K-12 Cybersecurity Leadership Conference

In the News

Insult to Injury: Cyberattack prompts closure of Uvalde (TX) schools

The Uvalde Consolidated Independent School District - yes, that Uvalde - had to close their school system for a week while responding to a significant ransomware incident experienced on September 13. District officials notified teachers and students that due to the attack, essential systems will be unavailable, including phones, thermostats, camera monitoring and other systems deemed necessary. The attack also took out the district’s payroll system, affecting bus drivers, maintenance staff and custodians. Officials said paychecks could possibly be delayed. District officials claim to have found no evidence of unauthorized access to sensitive data, but time will tell.

“An Absolute New Low” - Extorting Nursery School Parents in the UK

Hackers say they have stolen the pictures, names and addresses of around 8,000 children from the Kido nursery chain. The gang of cyber criminals is using the highly sensitive information to demand a ransom from the company, which has 18 sites in and around London, with more in the US and India. The criminals also claim to have contacted some parents by phone as part of their extortion tactics.

Audit: Utah's K-12 systems could improve cybersecurity practices

Utah’s local education agencies (LEAs) are not fully implementing baseline cybersecurity practices, leaving school systems vulnerable. Recent attacks in Utah exposed data from hundreds of thousands of students and employees and cost districts over $150,000. Testing and statewide surveys found significant gaps in incident response planning, training, and patch management, with smaller districts lagging furthest behind. Barriers such as insufficient staffing, limited resources, and lack of prioritization continue to hinder progress. Among the recommendations to the Utah legislature: minimum cybersecurity standards for local education agencies. Direct link to the audit report here.

K12 SIX Announces Expert-Led Webinar Series for 2025 Cybersecurity Awareness Month

This October, in recognition of Cybersecurity Awareness Month, K12 SIX presents a series of weekly webinars designed to help schools strengthen their defenses against modern cyber threats. This series features the voices of industry experts and K-12 practitioners, collaborating to offer school technology leaders and administrators actionable strategies and essential guidance. Our goal is to empower school communities with the knowledge and tools needed to build a resilient and secure digital environment.

4th Annual National K-12 Cybersecurity Leadership Conference (Feb 2026): Call for Speakers, Registration Open

The National K-12 Cybersecurity Leadership Conference is a unique event designed to identify and share solutions and best practices to better defend the K-12 education sector from emerging cybersecurity threats, such as ransomware and data breaches. Participants from past conferences report overwhelmingly positive feedback about the conference: “I just wanted to reach out to say thank you again for an amazing conference. My team and I all agreed that was by far one of our best conferences any of us have ever attended.” The 4th Annual conference will be held February 24-26, 2026 in Albuquerque, NM.

Fast Facts

• 52: U.S. K-12 ransomware victims claimed by threat actors (2025 to date) (source)

• 72: Severe information technology vulnerabilities (CVSS Base Score 7.0+) disclosed in past week (source)

Members Get More

The K12 Security Information eXchange (K12 SIX) operates as the independent, non-profit information sharing and analysis center (ISAC) exclusively for the K-12 education sector. Founded in 2020, organizations eligible for membership include school districts, charter schools and charter management organizations, private/independent schools, regional education agencies, and state education agencies. K12 SIX members get more.

Mark Your Calendar

• 9/9 - Nonconsensual Deep Fakes: Surfacing Tech-Powered Harassment in K-12 Schools (Center for Democracy & Technology)

• 9/10 - Hack to School: Cyber Threats and Smarter Defenses for K-12 & Higher Ed (Privacy Technical Assistance Center/US Department of Education)

• 9/11 - Monthly Cross-Sector Threat Briefing (member-only)

• 9/17 - Data Breach Apocalypse: Incident Response in an Ever-Changing Threat Landscape (Privacy Technical Assistance Center/US Department of Education)

In the News

Hackers demanded SC school district pay ransom. They refused.

A June cyber attack against the Lexington-Richland 5 school district delayed the start of summer school, affected pay for teachers and staff, and exfiltrated more than 1 TB of  data, including personal information of more than 31,000 individuals. The State reports that the district received an extortion demand related to the attack but refused to pay. The threat actor Interlock has claimed responsibility for the attack.

Threat Actors Using Stealerium Malware to Attack Educational Organizations

Readily available to low-sophistication actors, commodity information stealers—such as Stealerium—have been deployed via phishing campaigns targeting universities and K-12 networks, with volumes ranging from hundreds to tens of thousands of emails per campaign. The information stealer Stealerium, e.g., has the capability to exfiltrate: keylogging and clipboard data; banking/credit card data (scraped from web forms); browser cookies, cache, and stored credentials; session tokens from gaming services (like Steam, Minecraft, BattleNet, and Uplay); email and chat data (Outlook, Signal, Discord, etc.); system data such as installed apps, hardware info, and Windows product keys; VPN services data (NordVPN, OpenVPN, ProtonVPN, etc.); Wi-Fi network information and passwords, crypto wallet data; and, other files deemed interesting (such as various types of images, source code, databases, and documents). Proofpoint finds that threat actors are increasingly seeking compromised identities, which is why they’ve observed a rise in the use of information stealers.

K12 SIX Calls on Secretary of Education to Enhance K-12 Cybersecurity with AI, for AI, and from AI

K12 SIX submitted comments regarding the U.S. Department of Education's new proposed funding priority—Advancing Artificial Intelligence in Education—for use in currently authorized discretionary grant programs, or such programs that may be authorized in the future. K12 SIX comments can be read here. Many other submissions are posted online at: https://www.regulations.gov/docket/ED-2025-OS-0118/comments

4th Annual National K-12 Cybersecurity Leadership Conference (Feb 2026): Call for Speakers, Registration Open

The National K-12 Cybersecurity Leadership Conference is a unique event designed to identify and share solutions and best practices to better defend the K-12 education sector from emerging cybersecurity threats, such as ransomware and data breaches. Participants from past conferences report overwhelmingly positive feedback about the conference: “I just wanted to reach out to say thank you again for an amazing conference. My team and I all agreed that was by far one of our best conferences any of us have ever attended.” The 4th Annual conference will be held February 24-26, 2026 in Albuquerque, NM.

Fast Facts

• 51: U.S. K-12 ransomware victims claimed by threat actors (2025 to date) (source)

• 32: Severe information technology vulnerabilities (CVSS Base Score 7.0+) disclosed in past week (source)

Members Get More

The K12 Security Information eXchange (K12 SIX) operates as the information sharing and analysis center (ISAC) exclusively for the K-12 education sector. Organizations eligible for membership include school districts, charter schools and charter management organizations, private/independent schools, regional education agencies, and state education agencies. K12 SIX members get more.