This article was originally published in MSN on 9/10/26 by Charlie Sander.
Here’s what schools should focus on the first weeks back to protect your data and systems.
For cybercriminals, the start of the school year is a particularly attractive window. With students, teachers, and administrators returning to work all at once, IT teams are stretched across competing priorities. Inboxes are full of legitimate-looking communications that staff are too distracted to strictly peruse and are more likely to respond to quickly, and attackers know this.
At a rushed time like this, there is another incentive cybercriminals are looking to exploit. A successful attack can be particularly disruptive at this point and potentially more lucrative with schools scrambling to restore systems before a new academic year. Attackers are known to use the quiet summer months to compromise accounts and systems and then execute the attack when the pressure to get operations running is at its peak.
More than 52% of U.S. school districts have experienced a cybersecurity incident in 2025, according to the 2026 Cybersecure report. That is a 16-percentage-point increase from 2024. Over time, third-party incidents have also risen sharply, from 4% of reported breaches in 2023 to a staggering 32% in 2025.
This seasonal pattern is visible in threat data, with DDoS attacks against educational systems doubling in August and September as compared to the preceding two months.
With AI in their arsenal, attackers can now create highly convincing social-engineering messages that imitate superintendents, IT administrators, and other staff, helping them develop malicious campaigns easily and quickly. As a result, AI phishing in schools has become more effective, and the time to detect and respond to it keeps shrinking.
So as students are settling back into their classes, officially closing the 2026 summer vacations across the country, what can schools do to keep themselves safe?
Start With the Accounts, Not the Hardware
As you prepare for students and school employees to return, focus on three things: account configurations, account activity, and lateral phishing.
First, a critical review of accounts, organizational units, and groups must be conducted with particular attention to users who have elevated access to sensitive information and systems. This is an area where problems often exist, and school districts happen to miss it.
Fight AI with AI. Learn more about AI-powered phishing protection solutions for K-12 schools today.
