Privacy & Security

What Schools Can Learn From the Biggest Cyberattack Ever on a Single District

By Alyson Klein — March 30, 2022 2 min read
Gloved hand reaching into a laptop screen hacking someone's account.
  • Save to favorites
  • Print

Hackers successfully targeted a New York City public school district vendor, jeopardizing personal information for some 820,000 current and former students. It was the biggest cyberattack on a single school district in U.S. history, according to Doug Levin, the national director of the K12 Security Information Exchange.

Levin, who has been tracking K12 cybersecurity incidents since 2016, said the January attack on the city school district is one of the clearest illustrations yet of how important it is that districts carefully vet the security practices of the vendors they work with.

The breach of Illuminate Education, whose software helped the nation’s largest school district track grades and attendance, means hackers now have access to personal information such as students’ names, birthdays, and special education and free-lunch statuses, the New York Post reported.

The New York City education department has accused the vendor of misrepresenting its security measures.

“We are outraged that Illuminate represented to us and schools that legally required, industry standard critical safeguards were in place when they were not,” David Banks, the district’s chancellor, told the Post.

The department did not immediately respond to questions from Education Week for more information.

See Also

Image shows a glowing futuristic background with lock on digital integrated circuit.
iStock/Getty Images Plus
Privacy & Security Explainer School Cyberattacks, Explained
Alyson Klein, February 11, 2022
12 min read

Illuminate is in the process of notifying individuals whose data may have been affected, the company said in a statement it provided to Education Week. The company added that “there is no evidence of any fraudulent or illegal activity related to this incident. The security of the data we have in our care is one of our highest priorities, and we have already taken important steps to help prevent this from happening again.”

That response leaves a lot of open questions, Levin said.

“Since they have not been forthcoming about what actually happened, it’s hard to know if they had a reasonable security program in place or not,” Levin said. “Just having an incident, in and of itself, should not necessarily mean that a company was negligent or acting in a reckless manner. Having said that, the lack of transparency here is concerning.”

It is possible that Illuminate misrepresented its cyber safeguards to the district, as the school system’s chancellor told the Post, Levin said. It’s also possible that the company was the victim of shrewd hackers, like those who have breached corporations that almost certainly spend more on cybersecurity than Illuminate, such as Microsoft, he added.

The breach comes as school districts across the country—and the companies that serve them—are increasingly hit by sophisticated cybercriminals, many of whom operate overseas in countries that are tough for U.S. law enforcement to reach.

And it underscores the need for school districts to be vigilant not just about their own security measures, but those of their vendors, Levin said. Vendor hacks can cause all sorts of problems for schools, he explained, noting that one New Hampshire district experienced a school milk shortage after a cyberattack on a local dairy.

“School districts in general, and this is not just a critique of New York, have not been evaluating their vendors based on vendor security practice,” said Levin. “Every type of vendor and supplier that a school district works with relies on technology, and if the school district relies on their services, they have an interest in ensuring that they have reasonable security practices in place.”


This content is provided by our sponsor. It is not written by and does not necessarily reflect the views of Education Week's editorial staff.
Early Childhood Webinar
How the Science of Reading Elevates Our Early Learners to Success
From the creators of ABCmouse, learn how a solution grounded in the science of reading can prepare our youngest learners for kindergarten.
Content provided by Age of Learning
This content is provided by our sponsor. It is not written by and does not necessarily reflect the views of Education Week's editorial staff.
English-Language Learners Webinar
Classroom Strategies for Building EL Students’ Confidence and Success
Fueling success for EL students who are learning new concepts while navigating an unfamiliar language. Join the national discussion of strategies and Q&A.
Content provided by Project Lead The Way
Future of Work Live Online Discussion Seat at the Table: Understanding the Critical Link Between Student Mental Health and the Future of Work
In recent months, there’s been a rallying cry against the teaching of social-emotional skills. Discover why students need these skills now more than ever.

EdWeek Top School Jobs

Teacher Jobs
Search over ten thousand teaching jobs nationwide — elementary, middle, high school and more.
View Jobs
Principal Jobs
Find hundreds of jobs for principals, assistant principals, and other school leadership roles.
View Jobs
Administrator Jobs
Over a thousand district-level jobs: superintendents, directors, more.
View Jobs
Support Staff Jobs
Search thousands of jobs, from paraprofessionals to counselors and more.
View Jobs

Read Next

Privacy & Security Cybersecurity a Top Ed-Tech Priority for States, But Funding Lags
Only 8 percent in a survey of state ed-tech leaders said their state provides “ample” funding for cybersecurity.
3 min read
 abstract digital key with technology interface, cybersecurity, key, lock, cellphone, fingerprint, and cloud computing icons
As schools increasingly turn to technology, the risk of cyberattacks have also grown.
iStock/Getty Images Plus
Privacy & Security Why the Los Angeles Cyberattack Is a Wake-Up Call for Every School District
A massive cyberattack shut off access to email and crippled the district’s website and systems used for teaching and attendance.
5 min read
Hacker attack and data breach, information leak and cybersecurity concept.
iStock/Getty Images Plus
This content is provided by our sponsor. It is not written by and does not necessarily reflect the views of Education Week's editorial staff.
Privacy & Security Quiz
Quiz Yourself: How Much Do You Know About Cybersecurity?
Answer 5 questions to assess your knowledge on cybersecurity.
Content provided by Bluum
Privacy & Security 'There Are So Many Issues’: Why Schools Are Struggling to Protect Student Data
While efforts have been made to protect student data, there are still troubling examples of data breaches.
8 min read
Illustration of numerous computer windows overlapping with creepy eyeballs inside the close, open, and minimize circles within the various window screens.
Daniel Hertzberg for Education Week