Cybersecurity in U.S. Public Schools: 2025 Update
Introduction
In today’s digitally connected education environment, cybersecurity in public schools is now a core facet of school safety and operational integrity. As education systems across the country continue to adopt cloud tools, remote-learning platforms, and large student-data systems, the risk of malicious attacks, data breaches and operational disruption has grown significantly. This article refreshes our earlier discussion of cybersecurity in public schools with the most current data, policy developments and expert insights for 2025, offering practical guidance for parents, students and educators alike.
The Threat Landscape in 2025
The data is stark. A recent report by Center for Internet Security (CIS) found that 82 % of K-12 organizations experienced a cyber incident during an 18-month period ending in early 2025. Other research by the RAND Corporation found that across the 2023–2024 and 2024–2025 school years, 60 % of school principals reported at least one cyber incident in their school — including 45 % who cited business-email compromise or phishing. Another global-education-sector survey indicated that schools averaged 4,388 cyberattacks per organisation per week in Q2 2025, a +31 % year-over-year increase.
What does this look like on the ground? Schools report incidents ranging from phishing, ransomware, student or staff email compromise, to denial-of-service attacks and data breaches of student records. These attacks threaten student privacy, disrupt online learning and require costly remediation. For example, ransomware in the education sector often leads to
