Data Privacy & Security Service Digital Digest_Spring 2019

The K-12 Cybersecurity Resource Center

K-12 Cyber Incidents: 2018

The most frequently experienced type of K-12 cyber incidents reported during 2018 were data breaches, primarily meeting one of the following four profiles : 1. Unauthorized disclosures of data by current and former K-12 staff, primarily—but not exclusively—due to human error. 2. Unauthorized disclosures of K-12 data held by vendors/ partners with a relationship to a school district. 3. Unauthorized access to data by K-12 students, often out of curiosity or a desire to modify school records (including grades, attendance records, or financial account balances). 4. Unauthorized access to data by unknown external actors, often for malicious purposes. Data Breaches • Just over half of all digital data breach incidents experienced by K-12 schools in 2018 were directly carried out or caused by members of the affected school community (staff or students). • Student data were included in more than 60% of K-12 data breaches in 2018. • During 2018, 46% of all K-12 digital data breaches

on school networks. • Perhaps most concerning in 2018 were a number of successful phishing attacks targeted at school district business officials. These scams—designed to redirect large payments from legitimate school contractors/ partners to criminal accounts—resulted in the theft of millions of tax payer dollars. Malware and Other Incidents • Responding to ransomware and other malware outbreaks - representing over 15% of all K-12 cyber incidents in 2018. • School-managed social media and website defacement - these incidents were experienced by about 5% of school districts in 2018. These attacks abuse official communication channels to deliver unauthorized messages or to automatically redirect users to third-party sites.

To read the full report use this link:

included data about current and former school staff (such as payroll or other personnel records). In some cases, this has led to payroll theft, identity theft, and the filing of false tax returns. Phishing Attacks • Phishing attacks— predominantly carried out over email, were commonly experienced by school districts. In many cases, these attacks were the method of choice that malicious third-parties employed to gain access to sensitive data systems or to deliver and propagate malware

Permission to use graphic provided by the K-12 Cybersecurity Resource Center, Powered by Knack

Made with FlippingBook - professional solution for displaying marketing and sales documents online