More than 20 school districts across Long Island were hit by cyber hackers leaving more than 10,000 students’ records and personal info vulnerable to criminals, state education records revealed.
The widespread data breaches and digital intrusions — 28 Long Island incidents were self-reported to the state last year — have cybersecurity experts sounding the alarm about schools nationwide increasingly becoming targets for identity thieves, ransomware gangs and data extortionists.
Districts with lower operating budgets are even more at risk, according to experts.
“Schools have an incredibly rich amount of data,” Randy Rose, vice president of security operations at the Center for Internet Security told Newsday. “People think it’s just grades — but it’s personal information, sometimes financial information.
“There’s data associated with kids that are in need. Data on kids that are in afterschool programs.”
Some of the intrusions on Long Island were minor — a student who was caught snooping on a classmate’s grades — but others were much more concerning.
Third-party breaches compromised the personal records of more than 6,000 students in Great Neck, another 1,000 Smithtown, as well as nearly 2,400 in Brentwood and Hewlett-Woodmere combined, according to state education records.
Hackers even infiltrated software systems used by schools across the US, including major safety and security platform Raptor Technologies, which impacted at least seven Long Island districts, education records show.
Michael Nizich, an adjunct associate professor of computer science at the New York Institute of Technology, said the level of regularly updated cybersecurity prevention necessary to adequately protect school districts is “just not going to be feasible” economically.
“I think what you’re seeing is that these school districts are now becoming targets because of the value of data that criminals are starting to find,” Nizich told Newsday.
But it’s not always the firewall that fails. Oftentimes breaches boil down to human error, as cybersecurity investments only go so far without proper training.
About 45% of the time, hackers weren’t exploiting technical flaws, but instead human behavior, according to an investigation by Newsday — pointing to phishing emails, fake login pages and malware disguised as digital ads.
And the real-world impacts on districts can be devastating, as cyber incidents can derail afterschool initiatives, delay lunch programs, disrupt statewide testing — even freeze entire school operations, Rose explained.
For students, the possible “real life consequences” can be even more dire — derailing credit scores and impacting their ability to apply for loans and credit cards.
“When it comes time to go to college or get their first bank account, credit card, they’re unable to,” Rose told Newsday.
The new state budget just added record funding into public education, including an additional $270 million for Long Island, although each individual district will decide how the money gets spent.