More than half of K-12 schools and districts experienced a cybersecurity incident in the past year, according to a report released Tuesday by the Center for Internet Security, the Multi-State Information Sharing and Analysis Center, and the Consortium for School Networking. The report surveyed 426 K-12 cybersecurity and technology leaders between August and September.

Of the schools that reported cyber incidents, 34% said the attack affected day-to-day school operations. The incidents extended beyond stolen data. Cyber attacks disrupted classroom instruction, student information systems, communications, payroll and other essential services that affected students, faculty and their families.

Staffing poses a major challenge. Sixty-six percent of surveyed schools and districts said they have only one or two dedicated cybersecurity staff members. Almost 80% of respondents said they needed additional cybersecurity support, resources or guidance. Fifty-six percent said their cybersecurity programs were underfunded, and 70% said budget constraints had forced them to delay cybersecurity projects, technology investments or staffing.

Phishing attacks and email compromises led the list of cyber incidents, with 87% of surveyed K-12 leaders reporting them. The report noted that artificial intelligence can make phishing messages and impersonation attempts more convincing. Many schools lack formal AI-use policies even as adoption spreads.

Michael Patton, superintendent of Saratoga Springs City School District in New York, said: "I worry that most of us are not well prepared" for major cyber events, despite decades of training for other types of incidents.

The report recommended that districts strengthen identity protection and multifactor authentication, provide regular cybersecurity awareness training, establish incident response plans, create formal AI policies, and use threat-monitoring services like the MS-ISAC's Malicious Domain Blocking and Reporting service. That service blocked 3.52 billion connections to malicious destinations, an average of more than 3.1 million per protected organization.