Why are schools a target?

They have many accounts, many users who bring their own devices, and open networks. A single stolen login can be enough to get a foothold.

Can we watch student accounts?

The platform matches findings to your domains. Decide with your privacy lead how student data is handled, and keep access to findings small.

Do you cover vendors?

You can watch the exposure of key vendors with the supplier part of the platform. It does not replace a vendor review.

Does this page name threat groups?

No. We only name a group when a government or standards source links it to the sector. Most attackers here are criminals.

How do stolen student logins end up for sale?

Infostealer malware on personal and school devices copies saved passwords. The logs are sold and the logins are reused. Dark Web Monitoring alerts you when staff or student logins on your domains are found in stealer logs or breach dumps.

What are forgotten systems at a university?

They are old course sites and test servers that still face the internet and nobody watches. Departmental systems that a single office set up are a common example. External Attack Surface Management lists the systems your institution exposes, including ones nobody reported.

How do fake login pages target schools and parents?

Messages pose as the school or a finance office and try to collect logins or payments. They can lead to a fake login page that copies your school or university. Phishing Monitoring and Domain Abuse finds fake login pages that copy your school or university.

Does GDPR apply to a university?

GDPR is the EU's main data protection law. It applies to organizations established in the EU that process personal data. It also applies to organizations outside the EU that offer goods or services to people in the EU or monitor their behavior.

What should a school with a small security team watch first?

Schools run many accounts and many systems, often with small security teams. Stolen logins and forgotten systems are two good places to start. Dark Web Monitoring covers leaked logins and External Attack Surface Management covers systems nobody listed.

Industry · Education

Staff And Student Logins Are Being Stolen.

Schools and universities have many users and many systems. Stolen logins are an easy way in.

Request A Demo See The Platform

What We Watch For Education 4 Threats

01Stolen Staff And Student Logins Watched
02A Vendor Login That Reaches Many Schools Watched
03Phishing Of Staff And Parents Watched
04Forgotten Systems Watched

In Short

Schools and universities run many accounts and many systems, often with small security teams. Education attackers go after stolen logins, forgotten systems and the software vendors that hold student data. Watching outside the network shows these early, before staff, students or parents are affected.

At A GlanceStolen staff and student logins, vendor breaches, phishing and forgotten systems at schools and universities, and the rules that apply.

Main Threats

What Threatens Schools And Universities.

Glossary term Stolen Staff And Student Logins Infostealer malware on personal and school devices copies saved passwords. The logs are sold and the logins reused. See The Definition → Incident A Vendor Login That Reaches Many Schools In late 2024 an attacker used a contractor's compromised login to get into PowerSchool, which runs student information systems for schools. Read The Incident → Glossary term Phishing Of Staff And Parents Messages that pose as the school or a finance office, sent to collect logins or payments. See The Definition → Glossary term Forgotten Systems Old course sites and test servers that still face the internet and nobody watches. See The Definition →

Compliance

Which Rules Apply To You.

FERPA (United States) The US law that sets requirements for protecting the privacy of parents and students. It applies to educational agencies and institutions that receive funds under programs administered by the US Secretary of Education. Official Site ↗

GDPR The EU's main data protection law. It applies to organizations established in the EU that process personal data, and to organizations outside the EU that offer goods or services to people in the EU or monitor their behavior. Official Site ↗

A plain summary of who each rule covers, taken from the official page. Not legal advice. Your legal team decides what applies to you.

Products

How Brandefense Helps.

Use Cases In This Sector All Use Cases →

Leaked Credential MonitoringFind stolen logins before they are used. Asset Discovery And Shadow ITFind systems your team does not know about.

Threat Landscape

Who Targets Education, And Where.

8Base Disrupted 8Base is the name of a ransomware affiliate group that used the Phobos ransomware. Since 2019 · Ransomware affiliate group using Phobos (Phobos itself is a ransomware as a service) Akira ransomware group Active Akira is a ransomware group active since March 2023. Since 2023 · Ransomware as a service (per MITRE ATT&CK) LockBit Disrupted LockBit is a ransomware as a service operation first seen in January 2020. Since 2020 · Ransomware as a service Medusa Active Medusa is a ransomware-as-a-service operation first identified in June 2021, according to the FBI, CISA and HHS. Since 2021 · Ransomware as a service (closed group until at least early 2023) Rhysida Active Rhysida is a ransomware operation that CISA, the FBI and the MS-ISAC say has mainly been deployed against education, healthcare, manufacturing, IT and government organizations since May 2023. Since 2023 · Ransomware as a service (profit-sharing with associates) Vice Society Ransomware group Vice Society is an intrusion, exfiltration and extortion group that first appeared in summer 2021, per joint advisory AA22-249A (FBI, CISA and MS-ISAC, September 6, 2022). Since 2021 · Not stated in the advisory Warlock Ransomware group Warlock is a ransomware family that Microsoft says a China-based actor it tracks as Storm-2603 deployed in July 2025 after exploiting on-premises SharePoint servers. Since 2025 · Not stated by the sources

British Library ransomware attack Incident The British Library ransomware attack began on Saturday 28 October 2023, when the Library found that ransomware had hit most of its online systems. October 2023 · Education PowerSchool data breach Incident In late 2024, an attacker used a PowerSchool contractor's compromised login to reach the student information systems of PowerSchool's school customers and copied data out. 2024 to 2025 · Education

France Country France faces espionage by state-linked groups, data theft and ransomware, and attacks around big events such as the Paris 2024 Games. Europe Japan Country Japan faces cyber espionage linked by its police to China and North Korea, ransomware against manufacturers and smaller firms, and theft of crypto assets. Asia Pacific Poland Country Poland faces cyber threats from state-linked actors such as APT28, Sandworm and Dragonfly, and from ransomware families such as LockBit. Europe Singapore Country Singapore faces state-linked espionage against its critical infrastructure, ransomware against businesses and a large volume of botnet infections. Asia Pacific South Africa Country South Africa has seen ransomware against national departments and state companies, and large leaks of personal data. Africa

FAQ

Frequently Asked Questions.

Why are schools a target?

They have many accounts, many users who bring their own devices, and open networks. A single stolen login can be enough to get a foothold.
Can we watch student accounts?

The platform matches findings to your domains. Decide with your privacy lead how student data is handled, and keep access to findings small.
Do you cover vendors?

You can watch the exposure of key vendors with the supplier part of the platform. It does not replace a vendor review.
Does this page name threat groups?

No. We only name a group when a government or standards source links it to the sector. Most attackers here are criminals.
How do stolen student logins end up for sale?

Infostealer malware on personal and school devices copies saved passwords. The logs are sold and the logins are reused. Dark Web Monitoring alerts you when staff or student logins on your domains are found in stealer logs or breach dumps.
What are forgotten systems at a university?

They are old course sites and test servers that still face the internet and nobody watches. Departmental systems that a single office set up are a common example. External Attack Surface Management lists the systems your institution exposes, including ones nobody reported.
How do fake login pages target schools and parents?

Messages pose as the school or a finance office and try to collect logins or payments. They can lead to a fake login page that copies your school or university. Phishing Monitoring and Domain Abuse finds fake login pages that copy your school or university.
What does FERPA cover?

FERPA is the US law that sets requirements for protecting the privacy of parents and students. It applies to educational agencies and institutions that receive funds under programs administered by the US Secretary of Education. Your legal team decides what applies to you.
Does GDPR apply to a university?

GDPR is the EU's main data protection law. It applies to organizations established in the EU that process personal data. It also applies to organizations outside the EU that offer goods or services to people in the EU or monitor their behavior.
What should a school with a small security team watch first?

Schools run many accounts and many systems, often with small security teams. Stolen logins and forgotten systems are two good places to start. Dark Web Monitoring covers leaked logins and External Attack Surface Management covers systems nobody listed.

Mentioned In

Other Ways In.

All Roles →

RoleCIO and IT directorSee what your company exposes to the internet, which suppliers carry risk into your systems, and… RoleCISOSee what is exposed outside your network in terms a board understands, and know what to… Glossary termStealer logsStealer logs are bundles of data collected from an infected device by information-stealing malware. Glossary termThreat actorA threat actor is an individual or a group that poses a threat to an organization…

For Education

Stay Ahead Of Digital Threats.

Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.

Request a demo See The Platform