Loading story…
U.S. authorities warned that malicious cyber actors were actively targeting K-12 schools and other educational institutions as remote learning expanded, using ransomware, malware, phishing, DDoS attacks, and video-conference intrusions to disrupt classes and steal sensitive data. The joint FBI, CISA, and MS-ISAC advisory said schools had become targets of opportunity, with ransomware incidents rising sharply and commonly involving data theft and extortion; families observed in attacks included Ryuk, Maze, Nefilim, AKO, and Sodinokibi/REvil, while malware such as ZeuS and Shlayer also affected the sector.
Separate reporting on criminal forums showed underground sellers offering remote access to compromised schools and universities in the U.S., U.K., Australia, Israel, and Germany, with listings priced from $200 to $17,000 based on victim size and privilege level. The activity coincided with leaked credentials, exposed FTP servers, and student-data incidents tied to education and e-learning platforms, reinforcing concerns about weak remote-access security, exposed RDP and SMB services, end-of-life software, and third-party edtech risks; officials urged patching, MFA, network segmentation, offline backups, DDoS protections, tighter conferencing controls, and stronger vetting of service providers.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On December 10, 2020, the FBI, CISA, and MS-ISAC published a joint cybersecurity advisory warning that malicious cyber actors were targeting U.S. K-12 educational institutions. The advisory described ransomware, malware, DDoS attacks, data theft, and distance-learning disruptions affecting schools.
According to MS-ISAC data cited in the joint advisory, 57% of ransomware incidents reported in August and September 2020 involved K-12 schools. This was a sharp increase from 28% of reported ransomware incidents from January through July 2020.
KELA reported that during August it tracked more than 45 remote-access listings across major underground forums, including 7 involving educational institutions. The listings primarily affected schools and universities in the US and UK, with additional victims in Australia, Israel, and Germany.
The CISA/FBI/MS-ISAC advisory says that since March 2020 the agencies had received numerous reports of uninvited users disrupting live video-conferenced classroom sessions. Reported disruptions included harassment, pornography or violent imagery, and doxing of attendees.
The KELA article states that data tied to K7math, an Australian e-learning service, had previously been leaked for free in March. It says a later listing linked to an Australian Education Department was connected back to this earlier K7math leak.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Educational institutions are increasingly targeted by cybercriminals, with ransomware attacks causing significant operational disruptions and data loss. In the United Kingdom, new figures from Ofqual reveal that while more teachers are receiving cybersecurity training, schools are taking longer to recover from cyber incidents. Only 55 percent of affected schools managed to recover immediately, a decline from the previous year, and 10 percent reported critical damage, nearly double the previous rate. The impact on students and staff is severe, with some schools losing coursework and lesson plans permanently, forcing teachers to recreate resources and disrupting classes for weeks. One unnamed academy trust experienced such extensive damage that staff across the organization had to rebuild schedules and resources from scratch. The human cost is substantial, as students’ academic progress is directly affected by the loss of critical educational materials. Ofqual has responded by urging schools to strengthen their cyber defenses, emphasizing the importance of regular data backups and robust malware protection. In the United States, the South Lyon Community School District was forced to shut down schools after a ransomware attack crippled phone systems and emergency response sub-systems. Although there is no evidence that student or faculty data was compromised in this incident, the attack severely disrupted normal operations and highlighted vulnerabilities in critical infrastructure. According to the Center for Internet Security, 82% of K-12 schools in the U.S. experienced a cyber incident between July 2023 and December 2024, underscoring the widespread nature of the threat. The South Lyon attack was attributed to a well-known ransomware group, though officials have not disclosed the group’s identity. The incident demonstrates that even with increased awareness and training, schools remain vulnerable to sophisticated attacks that can bypass existing defenses. Both UK and US authorities stress that the cost of prevention, including reliable backup and recovery strategies, is far less than the cost of responding to a successful attack. The growing frequency and severity of these incidents have prompted calls for greater investment in cybersecurity measures across the education sector. The loss of access to emergency systems, as seen in South Lyon, raises additional concerns about student safety during critical events. The trend of longer recovery times and more severe outcomes suggests that attackers are employing more destructive tactics, making it harder for schools to restore normal operations. The publication of sensitive data, as referenced in other UK incidents, further illustrates the risks to student privacy and institutional reputation. As schools continue to digitize their operations, the need for comprehensive cybersecurity strategies becomes increasingly urgent. The educational sector’s unique challenges, including limited budgets and legacy systems, make it a prime target for ransomware groups seeking to maximize disruption. Authorities recommend that schools prioritize regular backups, employee training, and incident response planning to mitigate the impact of future attacks. The ongoing wave of ransomware incidents serves as a stark reminder that educational institutions must remain vigilant and proactive in defending against evolving cyber threats.
Jun 29, 2026
The FBI, CISA, and MS-ISAC issued a joint **#StopRansomware** advisory warning that the **Vice Society** intrusion and extortion group has disproportionately targeted the education sector, particularly **K-12 schools**. The group has caused network outages, delayed exams, canceled school days, and theft of student and staff personal information. Investigators said Vice Society has been active since at least summer 2021 and uses **double extortion**, stealing data before encrypting systems and threatening to publish it if victims refuse to pay. Authorities said Vice Society does not depend on a single ransomware strain, instead deploying variants including **Hello Kitty/Five Hands** and **Zeppelin**. The group has gained access through exploitation of internet-facing applications and compromised credentials, then moved laterally using tools such as **SystemBC**, **PowerShell Empire**, and **Cobalt Strike**, while escalating privileges through **PrintNightmare** flaws `CVE-2021-1675` and `CVE-2021-34527`. The advisory included indicators of compromise such as OnionMail addresses, a Tor leak site, command-and-control IP addresses, and file hashes, and urged organizations to prioritize patching known exploited vulnerabilities, enforce phishing-resistant MFA, maintain offline immutable backups, secure RDP, segment networks, and restrict SMB and other unnecessary ports.
Jun 29, 2026
Cybercriminals are increasingly targeting **education technology vendors** and learning platforms to reach large numbers of schools, students, and staff in a single intrusion. Reporting tied the trend to attacks claimed by **ShinyHunters**, including breaches involving EdTech platforms, a Salesforce-related theft affecting **Infinite Campus** staff accounts, and a major compromise of **Instructure Canvas LMS** that allegedly exposed **3.65TB** of data spanning nearly **9,000 schools** and **275 million users**. Additional incidents reportedly affected higher-education environments running **Oracle PeopleSoft**, while newly named victims included **Glendale Community College** and **Moody Bible Institute**.
Jun 29, 2026