Blog Post [ELM#1144] Steps to Protect Student and Staff Data From Ransomware

How do we protect student and staff data when ransomware attacks keep climbing, our IT team is small, and every new app brings another vendor? I hear this question in cabinet meetings and budget workshops. It usually comes from someone who just approved one more software agreement. They know the danger is real. What they want is a place to start.

The latest numbers explain the worry. In a 2026 Sophos survey, 61% of K–12 organizations hit by ransomware had data encrypted, up from 29% a year earlier (Sophos, 2026). Identity-based techniques like phishing and stolen passwords appeared in 85% of education attacks. Nearly one in three K–12 victims needed a month or more to recover.

Here is where many of us go wrong. We treat cybersecurity as a technology department problem and leave it there. We buy another tool and expect it to do the heavy lifting. We trust vendors because their names are familiar, then sign contracts without asking hard questions.

The PowerSchool breach showed what that trust can cost. In December 2024, an intruder used one compromised password on a support portal that lacked multifactor authentication (Fioccola et al., 2025). Records tied to roughly 62 million students and 9.5 million educators were exposed. Districts in dozens of states had to notify families about a door they never controlled.

Protecting data is a leadership duty before it is a technical one. No small IT team can stand alone against threats built to outrun it. I learned that lesson during a storm, not a server outage.

In September 2022, Hurricane Ian was forecast to make landfall near our Florida home. Schools had closed to students but opened as shelters for displaced residents. While neighbors prepared their houses, I was supporting our shelters. My husband was busy securing his company.

When I pulled into the driveway, our storm shutters still were not up. The job would take my husband hours, and time was running out. I flopped onto the sofa, completely overwhelmed. Then I heard voices outside and saw a team putting up shutters next door.

I walked over, explained our situation, and asked for help. Soon that same team was at our house. My husband joined them when he got home. New people arrived as others left, yet the goal never changed. Together they protected several homes instead of one.

After the storm passed, those neighbors came back and took the shutters down. Two lessons have stayed with me. A committed team covers far more ground than one household working alone. A clear purpose keeps that team steady even when the faces change. Your IT department is that one household, and it needs neighbors.

Put the Shutters Up Before the Storm

CISA’s K–12 Cybersecurity Foundations guide, released in August 2026, was written for schools short on people, money, or expertise (CISA, 2026). It names four starting objectives. I would ask every leadership team to treat them as non-negotiable.

1. Protect every login. Require multifactor authentication, starting with accounts that hold sensitive data or administrator rights. Revoke access the day someone leaves.
2. Close the open windows. Patch internet-facing systems and enroll in CISA’s free vulnerability scanning. Fix what the reports find, starting with the highest risk.
3. Prove the backups work. Keep copies separate from the network and run full restoration tests. Ask to see evidence of a test, not a promise.
4. Rehearse the response. Write an incident plan, keep a printed copy, and run a tabletop exercise at least once a year.

Next, bring that discipline into procurement. Fioccola et al. (2025) urge contracts that require multifactor authentication, encryption, audit rights, and termination triggers for security failures. At minimum, every agreement touching district data should include:

• Multifactor authentication on every vendor portal tied to district data
• A breach notification timeline in writing
• Data deletion when the contract or pilot ends

Finally, find your neighbors. K12 SIX shares threat intelligence built for schools, and CISA offers no-cost services and tabletop exercise packages (CISA, 2026; K12 SIX, n.d.). These partners don’t replace your staff; they extend their reach.

Ross McKerchar, chief information security officer at Sophos, said it plainly: “Today’s attackers don’t need a crowbar when they can steal the keys” (Sophos, 2026). That is why logins sit first on CISA’s list. Guard the keys, and the locks can do their job.

So let me ask you. When did your team last restore a full system from backup? Which vendor holds your most sensitive records, and how fast would they call you?

This week, ask your technology leader for proof of one tested backup, then schedule a cyber tabletop exercise before winter break.

#EducationalLeader,
Kim

When schools are well led, students learn well.

References

• Cybersecurity and Infrastructure Security Agency. (2026). K-12 cybersecurity foundations: Getting started guide. U.S. Department of Homeland Security.
• Fioccola, D., Francis, A., & Cuevas, C. (2025, March). The PowerSchool breach: A privacy lesson on third-party risk exposure. Proskauer on Privacy.
• K12 Security Information eXchange. (n.d.). Leadership.
• Moore, K. D. (2022). Leaders ask their teams for help. Dr. Kim Moore: #EducationalLeader.
• Sophos. (2026, August). Identity-based attacks are responsible for 85% of ransomware in education, Sophos report finds [Press release]

The views shared herein are solely those of Dr. Kim D. Moore and do not necessarily reflect the positions of her employer, the school district, or any local, state, or federal government entity.