# Stolen staff logins are spreading attacks between K-12 school districts

DevFeed: [Stolen staff logins are spreading attacks between K-12 school districts](<https://devfeed.tech/articles/stolen-staff-logins-are-spreading-attacks-between-k-12-school-districts-105831.md>)

Original publisher: [Read original article](<https://www.helpnetsecurity.com/2026/10/29/cis-k-12-cybersecurity/>)

Author: Mirko Zorz

Published: 2026-10-29T05:00:01Z

Content type: news

Language: en

Sources: [Help Net Security](<https://devfeed.tech/sources/help-net-security.md>)

Topics: [Cybersecurity](<https://devfeed.tech/topics/cybersecurity.md>), [Credential theft](<https://devfeed.tech/topics/credential-theft.md>), [cyber resiliency](<https://devfeed.tech/topics/cyber-resiliency.md>), [Threat monitoring](<https://devfeed.tech/topics/threat-monitoring.md>)

Tags: [account](<https://devfeed.tech/tags/account.md>), [account-takeover](<https://devfeed.tech/tags/account-takeover.md>), [ads](<https://devfeed.tech/tags/ads.md>), [ai](<https://devfeed.tech/tags/ai.md>), [attacks](<https://devfeed.tech/tags/attacks.md>), [browser](<https://devfeed.tech/tags/browser.md>), [budget](<https://devfeed.tech/tags/budget.md>), [center-for-internet-security](<https://devfeed.tech/tags/center-for-internet-security.md>), [classroom](<https://devfeed.tech/tags/classroom.md>), [clickfix](<https://devfeed.tech/tags/clickfix.md>), [credentials](<https://devfeed.tech/tags/credentials.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [dark-web](<https://devfeed.tech/tags/dark-web.md>), [education](<https://devfeed.tech/tags/education.md>), [email](<https://devfeed.tech/tags/email.md>), [government](<https://devfeed.tech/tags/government.md>), [information](<https://devfeed.tech/tags/information.md>), [it](<https://devfeed.tech/tags/it.md>), [marketplaces](<https://devfeed.tech/tags/marketplaces.md>), [news](<https://devfeed.tech/tags/news.md>), [report](<https://devfeed.tech/tags/report.md>), [school](<https://devfeed.tech/tags/school.md>), [security](<https://devfeed.tech/tags/security.md>), [staff](<https://devfeed.tech/tags/staff.md>), [state](<https://devfeed.tech/tags/state.md>), [usa](<https://devfeed.tech/tags/usa.md>)

## AI overview

MS-ISAC reported that staff credentials from 808 of its 6,116 K-12 member organizations circulated on underground or dark web marketplaces last school year. Attackers used compromised district accounts to phish their contacts, including staff in other districts, with messages sent through authenticated email paths; CIS calls this "account takeover hopping" and assesses with high confidence that it will continue. The excerpt also reports malware delivered through malicious ads on legitimate sites and ClickFix lures, while most districts had only one or two people responsible for cybersecurity and many delayed security work because of budget limits. Although 83% had deployed MFA and filtered email, only 15% held regular incident response exercises. CIS recommends expanding MFA, monitoring for exposed credentials, reviewing privileged accounts, and conducting annual tabletop and operational response exercises with leadership; it also recommends recurring state funding for shared monitoring and response services.

## Source excerpt

Last school year, 808 K-12 school organizations got some unwelcome news. The Multi-State Information Sharing and Analysis Center (MS-ISAC) told them their staff accounts or credentials were circulating on underground and dark web marketplaces. That's 808 of the center's 6,116 K-12 members, and attackers are using those logins to get in the door and then reach the next district. In cases MS-ISAC tracked, an attacker phishes one legitimate district account, then uses it to send ... More -> The post Stolen staff logins are spreading attacks between K-12 school districts appeared first on Help Net Security.