Cybersecurity in Schools

The DfE has updated its cyber security standard for schools and colleges. The changes have been made to reflect the 2026 Cyber Essentials updates. The big one - MFA has moved from “senior leaders and staff handling sensitive data” to something much broader. The updated wording now says MFA must be enabled for: • all staff accounts with access to cloud services or on-site systems • IT administrative accounts For many schools, this means checking more than Microsoft 365. It means looking at MIS access, safeguarding systems, finance platforms, HR systems, remote access, admin accounts, cloud services and any other system staff use to access school data. The password wording has also been tightened. Users need unique credentials before accessing devices, the network and services. Passwords must be unique to the user, protected from unauthorised access and backed by technical controls that reduce the risk of compromise. There are also stronger references to approved applications, secure configuration, IoT devices, firewall protection and custom-built applications. The 14-day vulnerability fix requirement is still there too. Critical or high-risk fixes need to be dealt with within 14 days of release. This is not just an IT job. We can push out the updates, but staff need to reboot their devices to apply them. My take on these updates is that Cyber Essentials may not be compulsory for most schools, but the DfE standard is clearly moving closer to it. Schools and trusts that treat this as a once-a-year tick box will struggle. Schools and trusts that build MFA, patching, backups, account reviews and secure configuration into normal routines will be in a much better place. Calm, practical, evidence-based cyber security. That is where schools need to be heading.

I've now interviewed 24 school districts that got hit with ransomware. I asked all of them the same question: how did the attackers actually get in? Not one described anything exotic. It came down to three things. 1. An internet-facing system that wasn't patched fast enough. A VPN appliance. An exposed management port. A server - SharePoint or Exchange or IOT . The patch existed. It hadn't been applied. My working definition of "timely" (for critical "takeover level" vulnerabilities) is two weeks — and faster than that for anything on CISA's Known Exploited Vulnerabilities list. 2. Phishing plus local admin rights. Someone clicked. That alone is survivable. What wasn't survivable was that the account had local admin on the machine, and in several districts, the same local admin password was on every machine in the building. One click became the whole fleet. 3. Remote access without MFA. Staff and vendors both. A stolen password was enough to walk in the front door and log in looking like an employee. No exploit required. Three findings, three fixes: → Know exactly what of yours is reachable from the internet, and patch it on a 14-day clock. Get management interfaces off the public internet entirely. → Take local admin away from daily-driver accounts. Give every machine a unique local admin password. Reminder that Windows LAPS is free and ships in the box. → MFA on every remote access path. Every one. Including the vendor's. None of this is expensive. Most of it is unglamorous. All of it would have changed the outcome for the districts I talked to. I'll be posting a more in depth LinkedIn article about the same with additional guidance shortly, but wanted to get this out there. If you're in K-12 IT and want to compare notes, my DM is open. #K12 #Cybersecurity #Ransomware #EdTech

Shadow AI in Schools: The Vulnerability No One's Measuring A teacher uploads a class list to a free AI tool to help generate personalised feedback. An admissions officer pastes parent emails into ChatGPT to draft responses faster. A HR manager uses an AI transcription service for a safeguarding meeting. Each is trying to work more efficiently. None has checked where that data goes, how it's stored, or whether their institution has sanctioned its use. This is shadow AI: tools adopted informally across organisations, outside IT oversight, without malicious intent but with real security implications. And in education, where sensitive data is everywhere and resources are stretched, it's growing fast. The risk isn't theoretical. In March 2021, a ransomware attack on the Harris Federation: one of the UK's largest academy trusts, left 37,000 pupils unable to access email. Devices issued to students were disabled. Phone systems went down. The trust was at least the fourth multi-academy group hit that month alone. Schools had become "soft targets"more dependent on IT systems after the shift to remote learning, but with security increasingly de-prioritised. That was before AI-accelerated attacks. Before tools like Claude could be manipulated into conducting 80-90% of a cyberattack autonomously, as Anthropic revealed happened this September. Before one in six breaches involved attackers using AI. If education was a soft target then, what are we today? The shadow AI problem compounds the risk. IBM's latest Cost of a Data Breach Report found 63% of organisations lack AI governance policies. Among those that experienced AI-related breaches, 97% had inadequate access controls. Every unsanctioned tool is a potential vulnerability; an unmonitored doorway in an already under-defended building. This isn't about restricting innovation. AI tools offer genuine benefits, and organisations using them effectively in security are cutting breach detection times by 80 days. But adoption without oversight is a gamble; and in education, the stakes include safeguarding data, student records, and institutional trust. For school, college and university leaders, shadow AI raises uncomfortable questions: Do you know which AI tools are being used across your organisation? What data is being shared with them? Who's responsible for assessing the risk? The attackers have AI now. The question is whether your governance does too. I'm running a session on this topic Wednesday morning https://lnkd.in/eW88h-fd What I'm listening to: “Ready or Not” The Fugees What I am reading: 1929 by Andrew Ross Sorkin What I'm Baking Tarte Tatin https://lnkd.in/eSvE6iyw See you in the kitchen Prof Rose Luckin UCL and EVR Ltd #ShadowAI #Cybersecurity #EdTech #AIGovernance #SchoolLeadership #DataPrivacy #HigherEd #K12

The hidden crisis in our schools — and what it means for our future. I used to think cyber-attacks on schools were just about data breaches. But after digging into recent incidents, I realize it's far more urgent. School systems are not just vulnerable—they're structurally exposed. From compromised student data to halted operations during finals, the impact hits where it hurts: education, safety, and trust. Imagine your child's school being Bricked—finals canceled, safety systems offline, emergency response hampered. This isn't a movie plot — it’s happening now. Hackers stole 275 million student records, disrupted learning, and threatened safety, all because of outdated tech, lax controls, and easy access granted to vendors and contractors. Most importantly, these attacks aren't "IT problems"—they're safety and human issues. Our kids' identities, mental health, and safety are on the line. The solution? Zero Trust as a strategy (not a product). No more trusting that users, devices, or vendors are inherently safe because they're part of the system. Verify everything, enforce least privilege, segment networks, enforce MFA, and test backups regularly. It's not rocket science—it's discipline and strategy (and not doing the same dumb sh*t and expecting a different outcome). Schools need to shift from reactive patchwork to strategic defense. Ask your school board the hard questions about MFA, vendor controls, and incident plans (then watch them stroke out because they don't know what those words are). Because if we don’t act, the only winners are the hackers, and our kids pay the price. Worth thinking about. https://lnkd.in/e8kseXdH

Cyber Smart from the Start: Defending Finland’s Future in the Classroom Finland has long been celebrated for its world-class education system and commitment to digital innovation. But as technology becomes increasingly entwined with everyday life, new challenges are emerging—especially for the next generation. The rise of misinformation, cyberbullying, and online fraud means that teaching traditional subjects is no longer enough. Today’s students must be equipped with the tools to think critically, act safely, and defend themselves in the digital world. Disinformation campaigns, particularly from hostile foreign actors like Russia, have become more frequent and more sophisticated. These campaigns are not limited to military or political targets—they affect everyday citizens, manipulating emotions, distorting facts, and undermining democratic values. Finnish students must be taught how to recognize propaganda, question suspicious sources, and resist the temptation to share unverified information. But media literacy alone won’t cut it. Our young people also need to understand personal cybersecurity—from using secure passwords and avoiding phishing scams, to managing their online identity and digital footprint. By integrating cybersecurity and disinformation awareness into the national curriculum, we can ensure that Finnish students grow up not just smart, but cyber smart—ready to protect themselves, and their country, from the digital threats of today and tomorrow. #cybersecurity #education #Finland #CyberHygiene #misinformation #disinformation #PrimarySchool #SecondarySchool #privacy #WhyCantWeDoThatHere #democracy

275 MILLION STUDENTS. 9,000 SCHOOLS. ONE BREACH. AND IT'S HAPPENED TWICE. If your child uses Canvas, the learning management system trusted by universities and K-12 districts across the globe, their personal data may already be in the hands of cybercriminals. Instructure, the company behind Canvas LMS, has confirmed a major data breach. The ShinyHunters extortion gang is claiming responsibility, and the numbers are potentially staggering. What Was Exposed: 🔴 Names, email addresses, and student ID numbers 🔴 Private messages between students and teachers 🔴 Data tied to an estimated 275 million individuals 🔴 3.65 terabytes of exfiltrated data 🔴 Instructure's Salesforce instance — also compromised Here's what makes this worse: This is the second Instructure breach in less than eight months. ShinyHunters hit their Salesforce environment in September 2025, and now they're back. Same threat actor. Different attack vector. Same victims: your kids. In my 20 years with the Bureau, including years spent tracking cybercriminal networks, groups like ShinyHunters follow a ruthless and repeatable pattern. They don't disappear after a successful breach. They come back. Why? Because they already know the architecture. They've mapped the network, identified the weak points, and tested what works. When an organization gets hit twice by the same threat actor in under a year, that reveals a sad trutch: the root cause was never fully remediated. Patching the symptom isn't the same as closing the wound. And this time, the stakes couldn't be higher. We're not talking about compromised credit cards. We're talking about children's school records, private conversations, and student identities, data that can fuel phishing attacks, synthetic identity fraud, and social engineering campaigns targeting families for years. ✅ If Your Child's School Uses Canvas — Do This Now: 1️⃣ Watch for phishing. Expect targeted emails pretending to be from your school, Canvas, or "account security teams." Delete and report them. 2️⃣ Monitor your child's email account for suspicious login activity or password reset requests they didn't initiate. 3️⃣ Talk to your kids about not clicking links in emails, even ones that look like they're from teachers or classmates. 4️⃣ Contact your school district and ask what notifications are coming and what steps they're taking under FERPA obligations. 5️⃣ Consider a credit freeze for minors with Social Security numbers — yes, kids can be victims of identity theft too. ShinyHunters has issued a "pay or leak" ultimatum with a deadline of May 6th. Whether Instructure pays or doesn't, the data is already out there — and threat actors don't return what they steal. The education sector has become one of the most targeted industries in cybercrime — and our children are paying the price. #KnowledgeisProtection.

The Canvas data breach made me reflect on something I’ve been observing for a while. In the AI Preparedness Surveys we have run with the Association of School Business Administrators (ASBA) and Independent Schools of New Zealand, schools consistently rate their cybersecurity maturity higher than their data governance maturity. They then rate their data governance maturity higher than their ability to maintain up-to-date software registers. That should make every school leader pause. Because the logic runs the other way. If your software register is not up to date, you may not know what systems, apps, platforms, extensions and AI tools are being used across the school. If you don’t know what software is being used, you may not know where student, staff, parent and operational data is being stored, shared or integrated. And if you don’t know where your data is, your cybersecurity posture has a blind spot. The Canvas breach is a timely reminder that schools are no longer just managing their own systems. They are managing a growing ecosystem of third-party platforms, cloud tools, learning technologies, AI-enabled applications and integrations. Bring Anthropic’s Mythos into the picture, and this becomes even more urgent. The key issue is not whether schools are currently using Mythos. They are not. The issue is what Mythos represents: AI systems are becoming far more capable at identifying and exploiting software vulnerabilities. That means the speed, scale and sophistication of cyber risk is increasing. To put it simply. You cannot govern what you cannot see. And you cannot secure what you have not governed. Food for thought #AIinEducation #AIGovernance https://lnkd.in/gcitA8-d

ShinyHunters had listed another K-12 vendor on its leak site. Follett Software, the company behind Destiny. A week earlier, the same group claimed Instructure's Canvas LMS. Roughly 275 million records across 8,809 institutions. On May 7, they defaced Canvas login pages at about 330 schools. Before that, PowerSchool. If you are leading a school or district right now, you should be extremely concerned. The technology stack underneath modern schools has grown faster than our preparation programs, and many school leaders are underprepared. Here is why K-12 keeps drawing attackers. Districts hold birth dates, home addresses, parent contacts, IEP records, medical alerts, eligibility data, and increasingly biometric and behavioral data. 𝑾𝒉𝒊𝒍𝒆 𝒕𝒉𝒆 𝒅𝒂𝒕𝒂 𝒊𝒔 𝒓𝒊𝒄𝒉, 𝒕𝒉𝒆 𝒔𝒆𝒄𝒖𝒓𝒊𝒕𝒚 𝒊𝒏𝒗𝒆𝒔𝒕𝒎𝒆𝒏𝒕 𝒊𝒏 𝒎𝒐𝒔𝒕 𝒅𝒊𝒔𝒕𝒓𝒊𝒄𝒕𝒔 𝒊𝒔 𝒐𝒇𝒕𝒆𝒏 𝒊𝒏𝒂𝒅𝒆𝒒𝒖𝒂𝒕𝒆. That asymmetry is why we are being targeted. This is not because anyone in our schools is careless. Most superintendents and principals I know are working harder than ever. 𝑻𝒉𝒆 𝒓𝒐𝒍𝒆 𝒆𝒙𝒑𝒂𝒏𝒅𝒆𝒅 𝒇𝒂𝒔𝒕𝒆𝒓 𝒕𝒉𝒂𝒏 𝒕𝒉𝒆 𝒑𝒓𝒆𝒑𝒂𝒓𝒂𝒕𝒊𝒐𝒏 𝒑𝒊𝒑𝒆𝒍𝒊𝒏𝒆. I came up through teaching English. The only reason I know what I know is my doctorate in Learning Technologies from Pepperdine University Graduate School of Education and Psychology and the work I did on my own afterward. Many of my closest colleagues, who are incredibly caring and awesome leaders, came up through classroom teaching, coaching, or counseling. None of those paths taught us the difference between a SOC 2 Type I and Type II report, how to read a vendor's data flow diagram, how to evaluate whether SSO is enforced with phishing-resistant MFA, or how to distinguish a phishing simulation from a real intrusion. That is not a personal failing. 𝑻𝒉𝒂𝒕 𝒊𝒔 𝒂 𝒑𝒓𝒐𝒇𝒆𝒔𝒔𝒊𝒐𝒏 𝒕𝒉𝒂𝒕 𝒄𝒉𝒂𝒏𝒈𝒆𝒅 𝒖𝒏𝒅𝒆𝒓 𝒐𝒖𝒓 𝒇𝒆𝒆𝒕. So what can we, the school leaders, do? 1️⃣ 𝗕𝘂𝗶𝗹𝗱 𝗰𝘆𝗯𝗲𝗿𝘀𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗮𝗻𝗱 𝗱𝗮𝘁𝗮 𝗹𝗶𝘁𝗲𝗿𝗮𝗰𝘆 𝗶𝗻𝘁𝗼 𝗮𝗱𝗺𝗶𝗻𝗶𝘀𝘁𝗿𝗮𝘁𝗶𝘃𝗲 𝗹𝗲𝗮𝗿𝗻𝗶𝗻𝗴, not as a one-time training, but as ongoing practice with real scenarios. 2️⃣ 𝗩𝗮𝗹𝘂𝗲 𝘁𝗲𝗰𝗵𝗻𝗶𝗰𝗮𝗹 𝗳𝗹𝘂𝗲𝗻𝗰𝘆 𝗶𝗻 𝗵𝗶𝗿𝗶𝗻𝗴, alongside instructional leadership. One can't exist without the other. 3️⃣ 𝗧𝗿𝗲𝗮𝘁 𝗖𝗧𝗢𝘀 𝗮𝗻𝗱 𝗖𝗜𝗢𝘀 𝗮𝘀 𝗽𝗮𝗿𝘁𝗻𝗲𝗿𝘀, always, not only after something goes wrong. The breaches are not slowing down. The good news is that this is a learnable skill set, and the leaders growing into it become better partners to their teachers, families, and tech teams along the way. This is not a drill. This is our reality. And our students depend on us to do better. So I ask you, School Board members, Superintendents, and my fellow school leaders: 𝗪𝗵𝗮𝘁 𝗶𝘀 𝗼𝗻𝗲 𝘀𝘁𝗲𝗽 𝘆𝗼𝘂 𝗮𝗿𝗲 𝘁𝗮𝗸𝗶𝗻𝗴 𝘁𝗵𝗶𝘀 𝘆𝗲𝗮𝗿 𝘁𝗼 𝗴𝗿𝗼𝘄 𝘁𝗵𝗲 𝘁𝗲𝗰𝗵𝗻𝗶𝗰𝗮𝗹 𝗳𝗹𝘂𝗲𝗻𝗰𝘆 𝗼𝗳 𝘁𝗵𝗲 𝗽𝗲𝗼𝗽𝗹𝗲 𝗹𝗲𝗮𝗱𝗶𝗻𝗴 𝘆𝗼𝘂𝗿 𝘀𝗰𝗵𝗼𝗼𝗹𝘀?

If your EdTech startup gets hacked today... Will parents still trust you tomorrow? This is what I asked an EdTech founder last month when he told me I have 1M students every week on my EdTech platform It’s just an online class platform. Why would anyone hack us? 6 weeks later, their entire system was shut down. Thousands of student records leaked. Parents angry. Trust broken. Business… on pause. Here’s what no one tells you about running an EdTech company: You’re not just building a learning platform. You’re handling the future of children. And that comes with a huge responsibility. Here’s the truth: → Students’ personal info → Parents’ payment data → Exam results, learning history, behavioral patterns All of this is a goldmine for hackers. And EdTech startups are easy targets because most of them: → Don’t have full-time security teams → Use third-party tools without audits → Assume “nothing will happen to us” Until it does. I had to tell this real business case to him In 2024, an Indian EdTech app with over 1.2 million users was breached. Hackers got access to names, emails, phone numbers, and even login credentials. Parents panicked. Many withdrew their kids. The brand never fully recovered. Because in EdTech- trust is everything. And once it’s broken, it's almost impossible to fix. What do parents really want? → Safe platforms → Protected student data → Confidence that their child’s future won’t be exploited Cyber protection isn’t a tech issue. It’s a trust issue. Here’s what solid cyber security plans can do for EdTech companies: ✅ Encrypt & protect student data ✅ Stop ransomware & phishing attacks ✅ Build parent confidence ✅ Meet global privacy regulations (DPDP,GDPR, IT Act, etc.) ✅ Get listed with govt. EdTech directories & compliance boards ✅ Qualify for grants & incentives from MeitY, Digital India, and Startup India When you invest in cyber protection: → You protect your business. → You gain long-term parent trust. → You stay 10 steps ahead of regulators and competitors. EdTech is booming. But growth without protection is a trap. Let’s fix this before it breaks. Hi, I'm Krishan Pal (PMP) help EdTech founders set up affordable cyber security frameworks that protect their business, their students, and their peace of mind. → Simple tools → Smart systems → Govt-compliant policies → Training for your team You don’t need to be an IT expert. You just need to act before it’s too late. Curious how to start? Drop a “SECURE” in the comments or DM me. I’ll send you a free checklist of what your EdTech company must secure in 2025. Let’s keep learning safe. 🛡️ ♻️ Repost in your network to share with an EdTech founder or even Coaching institutions who've no cyber awareness/ protection 🔔 Follow Krishan Pal (PMP)for more such tips to protect your digital empires #EdTech #CyberSecurity #FounderTips #StartupIndia #DataProtection #StudentSafety #ParentTrust #CyberInsurance

💻🔒 Wouldn’t it be cool if public schools had the funding to protect their networks like large corporate America? Here’s the reality: 📌 Not all school districts are the same size. In my district, our tech team is just me and five repair technicians. Most of their time? Tier 1 support and Chromebook repairs. 📌 Most public schools don’t have a dedicated CISO (Chief Information Security Officer). I know because I wear that hat along with many others. Cybersecurity threats are real, and public schools are prime targets yet our budgets rarely match the risk. So, how do we change that? ✅ Advocacy: We need to educate policymakers on the critical importance of cybersecurity funding. ✅ Collaboration: Share resources and best practices between districts. ✅ Creativity: Partner with vendors and leverage grant opportunities. And here’s an ask for the EdTech sales community: We need you, too. Because when public schools are properly funded and protected, you thrive too. More secure schools mean more opportunities to deploy solutions, train staff, and grow your market. So let’s work together: 🤝 Educators, policymakers, and EdTech vendors let’s advocate for a safer digital environment for every student. 👉 How are you addressing cybersecurity with limited resources? 👉 EdTech sales leaders: how can you help us move this needle together? #Cybersecurity #Education #EdTech #SchoolSafety #Funding