Cyberattacks on Schools and Libraries: Prevention, Response, and Recovery

1. 01

   Information has value

   Personal records can be exploited

   Educational institutions and libraries may maintain names, addresses, contact details, account identifiers, employment records, and other sensitive information. Schools may also hold student records, while some libraries maintain records associated with borrowing, research, or public computer use.

   Depending on the records involved, stolen information may support identity fraud, phishing, impersonation, or further account compromise. Criminals may also threaten to publish stolen data to pressure an organization into paying.

   What this means

   Treat personal information as an asset that needs protection, not simply as data stored inside an administrative application.

2. 02

   Operational pressure

   Essential services cannot always stop

   Schools depend on systems for attendance, communications, scheduling, learning platforms, and administration. Libraries may depend on systems for circulation, public computer access, digital resources, and catalog searches.

   When these services become unavailable, the disruption can affect hundreds or thousands of people. Criminals may attempt to exploit the pressure to restore operations quickly.

   What this means

   Plan how essential services will operate during an outage. A tested continuity plan reduces the pressure to make rushed decisions.

3. 03

   Security constraints

   Small IT teams face a large workload

   A district or library system may have to support numerous devices, public networks, remote access services, specialized applications, and legacy equipment with a small IT team.

   Security updates, account reviews, monitoring, and recovery testing can be difficult to maintain consistently. Attackers may exploit exposed systems or credentials regardless of whether the organization is large or small.

   What this means

   Prioritize a few high-impact safeguards first: multifactor authentication, secure backups, timely patching, and a documented incident-response plan.

4. 04

   Connected systems

   A vendor can become the entry point

   Schools and libraries rely on outside providers for software, hosting, email, student information systems, library management, payment processing, and IT support.

   If a provider's account or infrastructure is compromised, customers may be affected even when their own systems have not been directly breached.

   What this means

   Know which vendors can access your systems and data. Require appropriate security controls, restrict vendor access, and establish a process for receiving incident notifications.

Information that deserves special attention

• Student information: Names, contact details, enrollment records, and other educational records maintained by the institution.
• Library patron information: Account details, contact information, and borrowing or research-related records where those records are retained.
• Employee records: Contact information, employment documents, payroll data, and account credentials.
• Identity and authentication data: Passwords, session tokens, recovery methods, and information that could help an attacker impersonate a user.
• Administrative information: Internal documents, financial records, schedules, contracts, and operational data.
• Third-party access: Information accessible to technology providers, contractors, and managed service providers.

Not all of these records will exist in every organization. The goal is to identify what is actually collected, where it is stored, who can access it, how long it is retained, and what would happen if it were disclosed or altered.

1. 01

   Credential theft

   Phishing and account compromise

   Attackers send convincing messages that encourage recipients to open a malicious attachment, visit a fraudulent sign-in page, or disclose authentication information.

   A compromised staff account may provide access to email, shared documents, administrative applications, or other connected services.

   Warning signs:

   • Unexpected password-reset or multifactor prompts.
   • Sign-in alerts from unfamiliar locations or devices.
   • Messages sent from an account that the owner did not write.
   • Unexpected requests to change payment or account details.

   Primary defense

   Use multifactor authentication, phishing-resistant authentication where practical, strong account recovery controls, and an easy process for reporting suspicious messages.

2. 02

   Data theft

   Data exfiltration

   Data exfiltration means transferring information out of an environment without authorization. An attacker may access files through a compromised account, an exposed service, or an application vulnerability.

   Stolen information may be used for fraud, sold, shared with other criminals, or used as leverage in an extortion attempt. Data theft can occur without ransomware encrypting any files.

   Warning signs:

   • Unexpected bulk downloads or unusual file access.
   • Unfamiliar forwarding rules or connected applications.
   • Unexpected transfers from cloud storage.
   • Security alerts involving unusual outbound activity.

   Primary defense

   Restrict access to sensitive data, monitor unusual activity, review application permissions, and minimize unnecessary copies of personal information.

3. 03

   Service disruption

   Ransomware

   Ransomware is malicious software that makes systems or data unavailable, commonly by encrypting files. Attackers demand payment in exchange for a promised recovery method or other concessions.

   Some operations also steal data before encrypting it. Consequently, restoring files from backups may resolve the encryption problem without resolving the data-exposure risk.

   Warning signs:

   • Files suddenly become inaccessible or change extensions.
   • Unexpected ransom notes appear.
   • Multiple devices or shared drives become unavailable.
   • Security tools report suspicious file changes.

   Primary defense

   Maintain isolated or immutable backups, protect administrative accounts, patch exposed systems, and rehearse a recovery plan.

4. 04

   Unauthorized access

   Exploitation of vulnerable systems

   Attackers may exploit unpatched software, insecure remote access, exposed administrative interfaces, or incorrectly configured cloud services.

   The initial weakness may be in an internet-facing server, a network appliance, a remote support tool, or an application that has not received security updates.

   Primary defense

   Maintain an asset inventory, prioritize security updates, restrict remote access, remove unused services, and monitor externally accessible systems.

5. 05

   Third-party compromise

   Attacks through service providers

   An organization may be affected through a compromised vendor, managed service provider, software update, or external administrator account.

   This can complicate an investigation because suspicious activity may originate from a trusted connection or a legitimate management tool.

   Primary defense

   Limit vendor permissions, require multifactor authentication, document external access, and establish clear escalation procedures with service providers.

6. 06

   Additional threats

   Business email fraud and denial of service

   Criminals may impersonate administrators or vendors to request fraudulent payments, redirect funds, or obtain sensitive information. Other attacks flood a website or online service with traffic to make it unavailable.

   These attacks may not involve malware or stolen databases, but they can still disrupt operations and cause financial or reputational harm.

   Primary defense

   Independently verify sensitive financial requests, protect email accounts, establish payment-change procedures, and maintain a plan for handling service outages.

1. 01

   Identity security

   Secure accounts and administrative access

   • Require multifactor authentication for email, remote access, cloud administration, and other sensitive services.
   • Use phishing-resistant authentication where practical, particularly for privileged accounts.
   • Give staff only the permissions needed for their jobs.
   • Separate ordinary user accounts from administrative accounts.
   • Remove access promptly when employees or contractors leave or change roles.
   • Review recovery methods, service accounts, and vendor access.

   High-priority action

   Start with email and administrator accounts. A compromised email account can expose information and enable further account takeovers.

2. 02

   Backup and recovery

   Maintain backups that attackers cannot easily destroy

   A backup is useful only if it is available, intact, and restorable. Backups connected to the same administrative environment may be exposed to the same attack.

   • Keep protected backups separate from ordinary production access.
   • Use offline or immutable backup copies where appropriate.
   • Protect backup administration with separate credentials and multifactor authentication.
   • Test restoration of important systems and data.
   • Define recovery priorities and acceptable downtime.

   Do not stop at “backup completed”

   Schedule actual restore tests. A successful backup job does not prove that the organization can recover its essential services.

3. 03

   System maintenance

   Patch, inventory, and reduce exposure

   • Maintain an inventory of computers, servers, network equipment, applications, and cloud services.
   • Prioritize exploited vulnerabilities and internet-facing systems.
   • Replace unsupported operating systems and applications when feasible.
   • Disable unnecessary remote-access services and unused accounts.
   • Use endpoint protection and centralized security logging appropriate to the environment.
   • Segment public computers from administrative systems, staff devices, and sensitive data.

   Practical example

   A public library's guest Wi-Fi and public-use computers should not have unrestricted access to staff workstations, servers, or administrative interfaces.

4. 04

   Data protection

   Know what information you hold

   • Identify sensitive information and the systems that store it.
   • Restrict access according to job responsibilities.
   • Encrypt sensitive information in transit and at rest where appropriate.
   • Establish retention and secure-disposal policies.
   • Review shared folders, cloud links, and third-party application permissions.
   • Protect exported reports and spreadsheets as carefully as the original database.

   Remember

   Encryption can protect information in certain circumstances, but it does not prevent an authorized account that has been compromised from accessing readable data.

5. 05

   Incident readiness

   Write a response plan before you need one

   During an incident, staff need to know who can authorize emergency actions, who contacts vendors, and who communicates with employees, families, patrons, and the public.

   • Identify an incident lead and backup decision-maker.
   • Maintain current contact details for IT, legal counsel, leadership, insurers, and critical vendors.
   • Identify qualified incident-response and recovery support.
   • Establish procedures for preserving evidence.
   • Prepare alternative communication methods if email is compromised.
   • Exercise the plan with a realistic tabletop scenario.

   Keep a usable copy offline

   Store emergency contacts, recovery instructions, and essential procedures somewhere that does not depend on the potentially compromised network.

6. 06

   People and processes

   Make reporting suspicious activity easy

   Staff should not need to determine whether an event is definitely malicious before reporting it. Quick reporting gives the response team a chance to investigate early.

   • Teach staff how to report suspicious emails and login alerts.
   • Explain how to report lost devices and accidental disclosures.
   • Train employees to verify unusual payment and data requests.
   • Establish clear procedures for communicating with families and library patrons.
   • Conduct periodic exercises and review lessons learned.

   Build a reporting culture

   Encourage prompt reporting instead of blame. Delayed reporting can give an attacker more time to expand access.

1. 01

   Immediate action

   Activate the response team

   Notify the designated incident lead, IT staff, and appropriate leadership. Bring in qualified incident-response support if the organization's capabilities are insufficient.

   • Record when the incident was first noticed.
   • Identify the systems, accounts, and services affected.
   • Use trusted communication channels.
   • Assign one person to maintain an incident log.

   Avoid fragmented decision-making

   Assign clear responsibilities so that containment, communications, evidence preservation, and operational decisions are coordinated.

2. 02

   Containment

   Isolate affected systems safely

   If a device is actively spreading malware or participating in an attack, disconnecting it from the network may help limit further damage. Follow the incident-response plan and the advice of qualified responders.

   • Isolate affected devices from wired and wireless networks.
   • Disable compromised accounts or revoke active sessions through trusted administrative access.
   • Restrict suspicious remote access and compromised integrations where appropriate.
   • Consider whether shared storage, backup systems, or other connected environments are at risk.

   Do not improvise a network-wide shutdown

   Broad shutdowns can disrupt essential services and destroy useful evidence. Coordinate containment with the incident lead, considering the scope and urgency of the threat.

3. 03

   Evidence preservation

   Preserve evidence before making unnecessary changes

   System logs, security alerts, email records, endpoint data, cloud audit logs, and ransom notes may help investigators determine how the attack occurred and what was accessed.

   • Record observations, timestamps, and actions taken.
   • Preserve relevant logs and security alerts.
   • Keep ransom notes and suspicious messages.
   • Document affected systems and known account compromises.
   • Follow professional guidance before wiping, rebuilding, or modifying affected devices.

   Important

   Do not casually delete files, run cleanup tools, or rebuild compromised systems before evidence requirements have been considered. Evidence collection should be handled by qualified personnel when possible.

4. 04

   Scope assessment

   Determine what may have been compromised

   Encryption and data theft are different problems. A team needs to investigate both rather than assuming that one explains the other.

   • Identify affected devices, accounts, servers, and services.
   • Determine whether privileged accounts were compromised.
   • Investigate suspicious downloads and access patterns.
   • Check whether backups and recovery credentials remain safe.
   • Identify personal information that may have been accessed or disclosed.

   Do not make unsupported claims

   Distinguish confirmed facts from suspected exposure and unknowns. A lack of visible evidence of data theft does not, by itself, prove that no data was taken.

5. 05

   Communication

   Coordinate internal and external notifications

   Leadership should coordinate communications with staff, families, patrons, governing bodies, technology providers, and relevant authorities as appropriate.

   • Use a trusted channel if organizational email may be compromised.
   • Provide clear instructions for reporting suspicious activity.
   • Avoid publishing unverified technical details or speculative claims about the attacker.
   • Coordinate with legal counsel and the relevant privacy or compliance contacts.
   • Establish a process for answering questions from affected individuals.

   Communicate responsibly

   Share what is known, what remains under investigation, which services are affected, and where people can obtain verified updates.

1. 01

   Secure recovery

   Restore systems from trusted sources

   • Verify that the incident has been sufficiently contained before reconnecting systems.
   • Restore from backups that have been checked for integrity and suitability.
   • Rebuild systems when their integrity cannot be trusted.
   • Apply necessary security updates and configuration changes.
   • Rotate compromised credentials and review privileged access.
   • Monitor restored systems for suspicious behavior.

   Validate before reconnecting

   Test critical applications, permissions, integrations, data integrity, and security monitoring before returning systems to normal operation.

2. 02

   Privacy and compliance

   Determine whether people must be notified

   If personal information may have been accessed or disclosed, the organization must assess its legal and contractual obligations. Requirements depend on the type of organization, the information involved, the people affected, and the applicable jurisdiction.

   • Identify the categories of information involved.
   • Establish what is confirmed and what remains uncertain.
   • Consult qualified legal and privacy professionals.
   • Determine applicable notification deadlines and recipients.
   • Document decisions and the evidence supporting them.

   Schools and libraries may have different obligations

   Educational records, library records, employee information, payment data, and other records may be subject to different legal requirements. Do not assume a single notification rule covers every type of information.

3. 03

   Support for affected people

   Give individuals practical guidance

   Where appropriate, explain what information may have been affected, what steps the organization has taken, and what individuals can do to reduce their own risk.

   • Recommend changing affected passwords through trusted channels, especially if credentials may have been exposed.
   • Encourage multifactor authentication on personal accounts.
   • Warn people about phishing messages that exploit knowledge of the incident.
   • Explain how to recognize suspicious account activity.
   • Direct affected people to appropriate identity-protection or fraud-reporting resources when warranted.

   Beware of follow-up scams

   Criminals may impersonate the school, library, a technology provider, or a recovery service. People should verify unexpected requests independently and avoid clicking links in unsolicited incident-related messages.

4. 04

   Root-cause analysis

   Find out how the incident happened

   The objective is not simply to identify the first suspicious email or compromised computer. The investigation should establish how access was obtained, how it expanded, what defenses failed, and which changes would reduce the risk of a similar incident.

   • Review the initial access method.
   • Examine account permissions and authentication controls.
   • Identify missing patches or unsafe configurations.
   • Review logging and detection gaps.
   • Evaluate vendor access and third-party dependencies.
   • Update procedures and assign owners to corrective actions.

   Make improvements measurable

   Assign responsibility and deadlines to corrective actions. Verify that changes have been implemented and tested.

5. 05

   Long-term resilience

   Reassess the security program

   Once immediate recovery is complete, review whether the organization can detect and contain a similar incident sooner in the future.

   • Repeat backup restoration tests.
   • Improve network segmentation and access restrictions.
   • Review security monitoring and alert escalation.
   • Revisit incident-response contacts and responsibilities.
   • Provide targeted staff training.
   • Reassess vendor security and recovery arrangements.

   Turn the incident into lasting improvements

   Document lessons learned and track corrective actions until they are complete. Recovery is also an opportunity to strengthen the organization's resilience.

If you are a parent or student

• Use unique passwords for school-related accounts and personal accounts.
• Enable multifactor authentication where available.
• Be cautious of messages requesting student details, password resets, payments, or identity documents.
• Verify unexpected messages with the school through a known, trusted contact method.
• Ask the school for official updates if it announces a data breach.

If you are a library patron

• Use a unique password for your library account if a password is required.
• Avoid entering sensitive information on untrusted public computers.
• Sign out of accounts and close browser sessions after using a public device.
• Watch for unexpected messages claiming to be from the library.
• Ask the library what information may have been affected if it reports an incident.

If you receive a breach notification

• Read the notice carefully and determine which information may have been involved.
• Follow the recommended steps using independently verified websites or contact details.
• Change affected passwords through the legitimate service, not through a link in an unexpected message.
• Monitor relevant accounts and financial activity when appropriate.
• Be particularly cautious of messages that use the incident to create urgency or demand payment.

1. 01

   Incident response

   NIST: Incident Response Recommendations

   Guidance for integrating incident response into an organization's broader cybersecurity risk-management program.

   Read NIST SP 800-61 Revision 3

2. 02

   Ransomware preparation

   NIST: Ransomware Protection and Response

   A collection of guidance on ransomware prevention, risk management, response, and recovery.

   Explore NIST ransomware resources

3. 03

   Data integrity

   NIST: Detecting and Responding to Ransomware

   Technical guidance on detecting, containing, and responding to events that compromise data integrity.

   Read the NIST data-integrity guide

4. 04

   Recovery planning

   NIST: Recovering from Ransomware and Other Destructive Events

   Guidance on restoring data and systems after events that damage or destroy information.

   Explore NIST recovery guidance

Organizations should also identify the appropriate education, library, privacy, cybersecurity, and law-enforcement contacts for their jurisdiction. Reporting requirements and available assistance vary according to the organization and the incident.