Stolen staff logins are spreading attacks between K-12 school districts

A new MS-ISAC report found that during the last school year, 808 of its 6,116 K-12 member organizations discovered their staff credentials for sale on dark web and underground forums. According to the Center for Internet Security (CIS), which operates MS-ISAC, attackers are chaining these stolen logins together: they compromise one district account, then use it to send convincing phishing messages—sent through legitimate, authenticated channels—to contacts at other schools, a technique CIS calls account takeover hopping. The same hijacked accounts have also been used to impersonate superintendents for fraud schemes. Beyond phishing, CIS found that about 65% of malware infections across the ten most common families originated from malicious ads on legitimate sites, plus 285 ClickFix-style incidents tricking users into running malicious commands—threats that standard phishing-awareness training doesn't cover. A companion survey of 426 school IT staff revealed thin defenses: 66% of districts have only one or two people handling cybersecurity, 11% have none, and 70% have delayed security investments due to budget constraints, even as 51% suffered a cyber incident in the past year, with 22% disrupting classes and 2% forcing school closures.