COVID-19 is amplifying the cybersecurity risks for schools as they move to distance learning; they were already at risk due to a lack of dedicated funding
and that was before classes moved almost entirely online. https://www.wired.com/... Lily Hay Newman / @lilyhnewman : “When I took a look, there was so much that was vulnerable—just a stupid amount of vulnerability. ” High schoolers (not to mention attackers) can, and will!, find flaws in their schools' digital systems until the security bar is much higher in K-12 https://www.wired.com/...
Context & Ripple Effects
This July 2020 Wired report was an early warning fired just as US classrooms went fully remote: reporter Lily Hay Newman found that school digital systems were riddled with vulnerabilities before the pandemic, and that underfunded K-12 districts had no dedicated security budget to fix them once every class moved online. Her framing — that high schoolers would find the same flaws attackers would — turned out to be prescient rather than alarmist.
The years of related coverage since have validated the thesis almost beat for beat: by November 2020 analysts counted nearly three dozen ransomware attacks on districts serving 700,000+ students, a 2020 tally put the toll at 77 attacks and roughly $6.6B in downtime across 1,740+ schools, and the 2022 Illuminate Education breach showed how vendor-held student records became a mass exposure point.
First-order effects
- Districts rushing to stand up distance learning overnight deployed student information systems, video platforms, and take-home devices without security review — putting millions of children's personal data behind underfunded defenses immediately.
- Students probing their own school portals, as Newman documented, became an accidental red-team force exposing weak authentication and exposed databases that IT staff with no security mandate had no process to remediate.
Second-order effects
- Criminal operators read the same weak defenses as opportunity, shifting ransomware campaigns toward school districts precisely because remote learning made downtime unbearable and backups thin — the wave documented through 2020 and beyond.
- Edtech vendors holding centralized troves of student records inherited the risk schools couldn't manage themselves, making suppliers like Illuminate the new breach perimeter for districts that outsourced the data.
Third-order effects
- If the pattern holds, the sector's structural response is accountability for disclosure as much as defense: Wired's 2025 investigation into 300+ attacks shows schools routinely withhold details from families whose data was stolen, pointing toward regulation of both school security spending and breach transparency.
- The funding gap itself becomes a policy battleground — a decade of unfunded digitization means K-12 cybersecurity is migrating from a local IT afterthought toward state and federal obligations, much as school device monitoring already forced privacy scrutiny of low-income students' laptops.
The trend: US K-12 is living through the collision course between rapid edtech digitization and chronically absent dedicated security funding, with student data as the standing casualty.