Cyberattacks still ravage schools, defying White House efforts launched last year

A year ago this week, First Lady Jill Biden entered the White House East Room, greeted by an audience of some 200 education technology stakeholders, to headline the launch of a Biden administration initiative to bolster school cybersecurity, following myriad incidents where hackers set their sights on school districts around the country. The digital intrusions have crippled schools’ tech infrastructure and led to compromises of sensitive student data, forcing administrators to direct funds away from vital services toward costly and prolonged IT overhauls.

For the initiative, the White House brought in private sector executives who, behind closed doors, worked out discussions with the Biden administration’s top cyber officials over the course of just a few weeks, agreeing to offer up free and subsidized cybersecurity resources for schools in need of added digital shielding. 

Recent years have proven that cyber threats to schools could no longer be ignored. Schools are a key sub-sector housed under the umbrella of government facilities, one of 16 critical infrastructure sectors designated by U.S. cyber experts. In the 2022 to 2023 school year alone, officials made note of multiple cyberattacks that targeted American school districts, according to a senior administration official who spoke to reporters last year in the hours leading up to the White House event.

Thousands of districts have since engaged in the services, according to conversations with vendor representatives. But they and other school cybersecurity observers haven’t noticed any significant reduction in threats. While a year-old program can only have so much near-term impact, some fear the commitments made last August ultimately won’t go far enough to keep hackers out of school networks.

“There’s still a long way to go to try to cover as many schools as we can,” said Zaid Zaid, who heads U.S. public policy at Cloudflare, one of the companies that, as part of the initiative, offered up free email protection services to public school districts with less than 2,500 students.

As of June, at least 112 districts in 29 states that cover some 150,000 students, faculty and staff have engaged with the Cloudflare offerings, according to company data shared with the Department of Education that was provided to Nextgov/FCW. 

One enrolled Mississippi school district has been catching some 4,000 malicious emails a day, Zaid said, citing discussions with administrators in the district, which is considered low-income. Cyberattacks have reduced as a result, he said, but for whatever reason, not every qualifying school has engaged with Cloudflare or other companies involved.

PowerSchool, a major educational technology provider, says thousands of school districts have viewed free training videos made by the company as part of its commitment to the Biden administration, according to Rich Gay, the company’s chief information security officer.

The company has also separately engaged with other vendors not involved in the initial White House talks, including Abnormal Security, which offers anti-phishing tools to help stop fraudulent emails from making their way into students’ school-provided inboxes.

The efforts aren’t for naught, said Gay, but public data from cyberattack research reports, coupled with PowerSchool’s direct business engagements with customers, shows a more sobering story for school districts put in the crosshairs of digital compromises.

“The bottom line is that attacks are increasing,” he said. Ransomware attacks — where a malicious actor uses malware to hold a computer network’s data hostage in exchange for a ransom payment — have been a popular tool for targeting schools because they are often deemed target-rich due to the reams of sensitive student information stored in school databases.

Country-wide culture surrounding district management is contributing to the problem, said Doug Levin, who heads K-12 SIX, a school cybersecurity information sharing analysis center that tracks school cyber incidents and helps member districts by providing threat intelligence and technical assistance to administrators wanting to shore up their digital defenses.

There are many U.S. school systems with just one IT person on premises to support users — that includes students, teachers, administrators, custodial staff and others. But an IT role isn’t necessarily a cybersecurity job, said Levin. And, when cyber intruders break into school networks, IT staff are forced to put on a different hat.

“This is being viewed largely in the [education] sector as a technical issue, and something that IT can just manage for the rest of the enterprise,” he said. “I think we still struggle in getting superintendent and non-IT leadership engaged on issues of operational resilience, and even in getting them to recognize how reliant school systems are today on technology.”

The danger isn’t just to school libraries’ Office 365 bundles or in-class Chromebooks used for student group projects. Today’s schools use technology for staff payroll, communicating with parents and securing buildings in the event of a dreaded incident where a physical intruder gets inside. 

“All of that stuff runs on the internet and is cloud hosted, in many cases, increasingly, and so that’s now exposing them to these risks they hadn’t had before,” Levin said.

Last month’s accidental, global CrowdStrike-enabled Windows outage pummeled school districts providing summer classes, a person with direct knowledge of the matter told Nextgov/FCW, who added that the outage would have led to country-wide school closures if classes were in full-time session. PowerSchool was directly affected, along with other school technology companies.

Even in wealthier parts of the U.S., school cyber incidents run rampant. Just north of Manhattan, in New York’s affluent Westchester County, five school districts were impacted when ed-tech software provider Illuminate Education was targeted in a data breach in late 2021 that affected around 3 million students. That’s according to a K-12 SIX tracking map that updates annually to log new school cyber episodes.

The types of hackers targeting schools come in all shapes and sizes, ranging from minor-league cybercriminals to operatives affiliated nation-state adversaries, said Oliver Page, who leads CyberNut, a school cybersecurity startup.

Those criminals are becoming more agile, he said. A cybersecurity service bolted onto school networks to protect students from being targeted with malicious emails may be defeated by a smart-enough hacker that can circumvent the cyber bulwark by instead compromising a teacher’s account and using that to send phishing emails to their students.

That isn’t a hypothetical scenario, said Page. 

“One of our customers actually had this happen to them. I think it was 4,000 students that all received some phishing scam from a teacher that spammed the entire database of students,” he said. Dozens of kids fell for it, sending PayPal payments to the phony user that was offering up a used video game console in exchange for the money.

Schools are target-rich environments, and they’re also frequently resource-poor, meaning that they can’t hire necessary technical staff to install and keep watch over cybersecurity services, said Steve Schmidt, Amazon’s chief security officer.

“If you look at a school system, the money that they get is limited,” he said in an interview with Nextgov/FCW last month. “They tend to focus on the things that are delivering value to the students directly. And IT security is not necessarily the highest on that list.”

Amazon last year committed $20 million to the White House effort, building out a K-12 cyber grant program, coupled with a smattering of other free offerings. Some 400 applications from educational institutions across 42 states have been sent in, amounting to over 20 million students, a company spokesperson said.

But money isn’t infinite, especially when the private sector is asked to voluntarily commit resources to a cause that has no underlying legal agreements. Whereas national security officials benefit from extensive ties with major tech companies, which often include legal obligations for data sharing in intelligence operations, school districts do not have access to similar partnerships.

The commitments spearheaded by the White House are certainly more effective than nothing at all, but the dynamic is leaving stakeholders wondering how to better position schools next to stop cyber adversaries from hoovering up their data.

Multiple sources who spoke to Nextgov/FCW for this story said continued outreach about the free and subsidized resources is critical for schools’ cyber success, but it’s tough for the government to get directly involved. 

The Education Department and other federal entities “are generally prohibited by law from endorsing or promoting private organizations, and so the vendors themselves primarily promote their services and support,” according to an agency spokesperson, who added that Education officials frequently speak with the White House about K-12 cybersecurity matters.

A federal subsidy bill could reinvigorate funding for schools’ technology resources, but it would have to clear the hurdle of getting enough lawmakers to direct taxpayer dollars toward such programs when the U.S. already funds areas deemed more vital to student success, like the National School Lunch Program. Top cyber officials are already facing separate but related concerns from the private sector about patchwork federal cybersecurity laws.

“As a voluntary effort … those that are able to take advantage of it have benefited, but they are essentially one-shot engagements,” Levin said, arguing that, ultimately, last year’s initiative hasn’t had an acute effect on reducing school cyberattacks.

The White House has continued to work out engagement with vendors, though no new promotional efforts linked to last year’s announcements appear to be planned. The Office of the National Cyber Director announced a nomination process last month for an award program dedicated to K-12 teachers in cybersecurity, indicating the initiatives remain a priority.