Schools on Their Own: K-12 Ransomware After the Federal Cuts

The renewal notice landed in district inboxes last October, and it asked for money nobody had budgeted. The Multi-State Information Sharing and Analysis Center, the threat-watching network that had quietly covered school systems for free for nearly two decades, now wanted dues. About $1,495 a year for a small district, more for big ones. And buried in the grant rules, a catch: federal cyber grant dollars can’t be used to pay it.

That invoice is the cleanest artifact of what changed for school cybersecurity over the past year. Between March 2025 and this spring, the federal scaffolding that quietly held up K-12 cyber defense was taken down piece by piece. Not with one dramatic announcement. With expirations, lapses, and reorganizations that each looked small on their own.

Meanwhile the people attacking schools did not pause to mark the occasion. They got more efficient.

What actually went away

Start with MS-ISAC, because schools leaned on it more than almost anyone. For a district with two IT people and 4,000 students, MS-ISAC was the security team: free malicious-domain blocking, threat alerts written for non-specialists, network monitoring, and a number to call at 2 a.m. when the file servers started encrypting themselves. In March 2025, CISA cut $10 million from its support. On September 30, the cooperative agreement that funded the rest of it ended outright, and the center moved to paid membership the next day.

The same September 30, the $1 billion State and Local Cybersecurity Grant Program lapsed. Congress revived its authority in the November shutdown deal, but the fine print mattered more than the headline: no new money was appropriated. A reauthorization bill passed the House and a Senate companion is still working through committee. Districts that built multi-year security plans around those grants are now planning around a question mark.

Zoom out and the pattern repeats. CISA has lost roughly a third of its workforce since early 2025, dropping from about 3,400 employees to around 2,400, and several of its education-facing programs were cut or shelved along the way. The Department of Education eliminated its Office of Educational Technology, the office that had published the playbooks district tech directors actually used. None of these cuts named schools as the target. Schools just happened to be the heaviest users of everything that got cut.

Figure 01 · Twelve months of disappearing backstops ScamDrill

Sources: The Record, StateScoop, StateTech Magazine, Cybersecurity Dive, 2025–2026 reporting.

Meanwhile, the attackers kept their schedule

The raw count of school ransomware incidents did not explode in 2025. It roughly plateaued, which sounds like good news until you look at what changed inside the number. Researchers at Comparitech confirmed 96 ransomware attacks on US K-12 schools in 2025, almost triple the 34 confirmed against colleges and universities. Across confirmed education attacks, exposed records climbed 27 percent to 3.9 million.

One gang explains a lot of that growth. Interlock claimed two K-12 attacks in 2024. In 2025 it claimed seventeen, including a breach at Georgia’s Cherokee County School District that exposed 46,000 records. The group’s specialty is the part that should worry parents most: it often doesn’t bother encrypting anything. It steals the student records and threatens to publish them.

That extortion-first model is why the vendor breaches sting twice. When PowerSchool was breached in December 2024, the company paid the hackers to delete the data. Months later, individual districts started getting their own ransom emails, built on the very records that were supposedly destroyed. Roughly 62 million students were in that dataset. And this spring the pattern repeated at even larger scale when ShinyHunters hit Instructure’s Canvas platform; we broke down that incident in our Canvas hack post. The lesson a year of vendor breaches has taught every district: your data lives in other people’s buildings, and their breach becomes your ransom note.

Figure 02 · Who got hit in 2025 ScamDrill

Source: Comparitech confirmed-attack data via Government Technology; Interlock claims tracked across 2024–2025.

The honest wrinkle: schools were getting better at this

Here is the part of the story that rarely makes the headline. By the numbers, schools spent 2025 improving. Sophos surveyed hundreds of education organizations hit by ransomware and found average recovery costs in lower education fell from $3.76 million to $2.20 million year over year. Median ransom demands dropped from $3.85 million to about $1 million. More districts restored from backups instead of paying.

Those gains came from unglamorous work: better backups, multi-factor authentication, incident plans that existed on paper before the bad day. But a lot of that work was scaffolded by exactly the things that just disappeared, free MS-ISAC monitoring, grant-funded assessments, federal advisors who would review a district’s plan for nothing. The next two years will test whether the improvement was structural or rented. A district that built habits keeps them. A district that depended on a free service it never had to think about is about to find out which kind it was.

Why this lands harder on schools than anyone else

Three structural facts make districts the softest target in the public sector. First, staffing: CoSN’s surveys have found that nearly 70 percent of districts have fewer than five IT staff, and many of those teams spend their days on Chromebook carts and bell schedules, not threat hunting. Second, budgets: among state and local organizations broadly, about 22 percent dedicate zero dollars specifically to cybersecurity. A district can’t raise prices or cut a product line to fund a security hire. The money comes out of the same pot as teachers and buses.

Third, and this is the one that changes how you should think about the whole problem: the data itself. A stolen credit card dies in a day. A child’s stolen identity can sit unused until they apply for their first student loan. The GAO’s review of school cyberattacks found districts lost three days to three weeks of learning after an attack, took two to nine months to fully recover, and ate direct costs from $50,000 to $1 million. The learning loss makes the news. The identity theft surfaces years later, quietly, one rejected loan application at a time.

Figure 03 · The bill that lands on a district ScamDrill

Sources: US Government Accountability Office; Sophos, The State of Ransomware in Education 2025.

A district playbook that doesn’t need a federal check

If you run technology for a district, or you sit on a school board deciding what to fund, the question is no longer “what does the federal government cover?” It covers very little. The honest question is what buys the most protection per dollar of local money. Our answer, in rough priority order:

Make the MS-ISAC decision on purpose. For most small districts, $1,495 is still the cheapest threat intelligence available anywhere, and nonprofit gap funding kept some services running through the transition. If you decide to skip it, decide who reads threat alerts instead. K12 SIX, the K-12-specific information sharing group, costs less than a classroom projector and was built for exactly this moment. Going without either is a choice; make it consciously, not by letting the renewal lapse.

Put MFA on staff email and the student information system before anything else. Most district incidents start with one phished staff credential, the same pattern we documented in dental and medical offices in our practice ransomware guide. One stolen login becomes payroll fraud, then lateral movement, then a leak site post with your students’ names on it.

Keep one backup the attacker can’t reach. Offline or immutable, and test-restored on a schedule someone’s name is attached to. The districts in the Sophos data that recovered cheaply were overwhelmingly the ones that restored instead of negotiated.

Give the business office a callback rule. Any change to vendor banking details or payroll direct deposit gets verified by phone, on a number you already had. This costs nothing and kills the single most expensive attack a district faces.

Drill people like you drill fire. The federal tabletop exercises and free training programs were among the first things cut, so the practice reps now have to come from somewhere else. Regular phishing simulations for staff, with a kind teachable moment instead of a wall of shame, build the one reflex that holds up when the technology fails. Our 30-day simulation plan was written for small businesses, and it maps onto a district office almost line for line.

Inventory your vendors. PowerSchool and Canvas were the loudest reminders that a district’s biggest breach may happen on someone else’s servers. List every vendor that holds student data. Ask each one two questions: do your employees use phishing-resistant MFA, and what exactly do you commit to telling us, and how fast, if you’re breached?

The era of borrowed muscle is over

For twenty years, the deal was implicit: schools ran thin IT shops, and the federal government supplied the missing muscle for free. That deal ended in the span of about twelve months, with no replacement on the schedule and a reauthorization bill still waiting on the Senate. Some states are stepping in to cover memberships. Most districts are simply absorbing the gap.

The encouraging part is that the defenses that actually moved the numbers in 2025 were never federal. They were local and mostly cheap: a second factor on a login, a backup nobody can touch, a phone call before money moves, a staff that has seen a fake before the real one arrives. Districts that build those habits will be fine without the safety net. The ones that don’t will be the line items in next year’s confirmed-attack count.