808 School Systems Were Told Their Staff Logins Were for Sale. Here Is How Attackers Use One District to Break Into the Next
A new Center for Internet Security report on K-12 cybersecurity finds that 808 member school organizations were warned last school year that staff credentials were circulating on criminal markets, and that attackers are using hijacked district accounts to phish neighboring districts. Here are the key findings and the lessons for any small organization.
More than one in eight. That is the share of K-12 organizations in MS-ISAC, the Multi-State Information Sharing and Analysis Center, that were alerted during the last school year that their employees’ usernames and passwords were for sale on underground markets: 808 out of 6,116. And a stolen school login rarely stays a single-district problem. Attackers are using those accounts as a springboard into neighboring districts.
The findings come from MS-ISAC’s parent organization, the Center for Internet Security (CIS), as reported by Help Net Security.
How the hop works
CIS calls it account takeover hopping. An attacker phishes one real staff account at a district. From that account, the attacker emails its contacts, including staff at other districts. Because the messages come from a genuine account over properly authenticated mail, they blunt the filters schools depend on. Attackers have also impersonated superintendents from hijacked accounts to commit fraud. CIS assesses with high confidence that the tactic will continue this school year.
Where the malware comes from
- CIS counted 1,796 infections from the ten malware families it sees most at K-12 members. Poisoned ads on otherwise legitimate websites accounted for 1,159 of them, or roughly 65%.
- Analysts recorded 285 ClickFix incidents, in which a fake prompt talks the user into running a malicious command.
- In 1,711 of 2,707 incidents where malicious activity reached a school-managed device, about 63%, attackers tried to avoid detection. The most common way, seen 881 times, was disabling or tampering with security tools.
Small teams, big gaps
In August and September, CIS and MS-ISAC polled 426 people who handle IT and security for schools. The picture is familiar to anyone who runs IT for a small organization:
- 66% rely on just one or two people for security, while 11% have nobody dedicated to it at all.
- 70% delayed security projects, purchases or hiring because of budget limits.
- 87% said phishing or email compromise is their most common incident.
- 51% dealt with a cyber incident during the prior year. 22% saw classroom instruction disrupted, and 2% had to close schools.
Good at blocking, less ready to recover
83% of surveyed districts have deployed multifactor authentication and the same share filter email. Recovery is weaker. 59% keep an incident response plan, only 15% practice it regularly, and just 9% describe their security strategy as fully implemented.
CIS recommends that districts widen multifactor sign-in, watch for leaked credentials, audit administrator-level accounts, and hold a yearly tabletop exercise plus a yearly hands-on response drill that includes leadership. It also urges states to provide ongoing money for monitoring and incident response services that districts can share.
What this means for your company
Swap “district” for “supplier” or “customer” and the hopping pattern looks just like the vendor email fraud that hits small businesses every day. A message from a real partner’s real mailbox is no longer proof of anything. Confirm payment and banking changes by phone using a number you already have, extend multifactor sign-in to every account (not just most of them), and watch for your staff’s credentials showing up in breach data. Because attackers routinely try to switch off security tools, set up an alert for any device that stops reporting to your protection software. And practice your response plan once a year so the first run-through is not the real thing.
Want a quick check of how your team would spot and stop an email coming from a hijacked partner account? Reach out to Layer 7 Data Solutions to discuss how we’ve helped companies similar to yours.
About The Author
