Is your school protected from ransomware? What K-12 leaders should do in 2026

Probably not as well as you think. In a 2026 survey from the Center for Internet Security (CIS), MS-ISAC, and CoSN, 59% of schools and districts said they have an incident response plan, and just 15% said they regularly use it in an exercise. Protection in 2026 means tested backups, multi-factor authentication, and a plan your team has practiced.

Picture it. It's an early Tuesday morning after a long three-day weekend. But today is different. Your systems and data are locked, and the only thing on your screen is a digital ransom note. Student data, financial records, and files are gone unless you pay, and this is not in the budget. This quick guide will help you prepare for the worst day of your life.

Ransomware

Malicious software that locks or encrypts an organization's files and demands payment for their return. In double extortion, attackers also copy the data and threaten to release it.

What does the K-12 ransomware picture look like now?

The numbers move up and down, and the risk stays. Comparitech recorded 130 ransomware attacks on U.S. educational institutions in 2025, 50 of them confirmed, K-12 Dive reported. Those counts include colleges. Comparitech then saw K-12 attacks worldwide fall 26% in the first half of 2026 from the half before, only to rise 24% from the second quarter to the third, from 25 to 31.

These are not abstractions. Delano Public Schools in Minnesota canceled classes for a day in May 2026, and LockBit demanded $1.2 million, GovTech reported. The district said it paid nothing because LockBit is a sanctioned organization, according to Comparitech. In Texas, Alamo Heights ISD had systems down for five days after a March attack and 26,629 people affected, Comparitech reported. Comparitech also lists Springfield Public Schools, where the start of term was delayed four days in the third quarter of 2026.

Vendors are a door too. Attacks on platforms are a separate story, and our post on AI ethics and student data covers what they mean for your records and contracts. This post stays on your own building: your network, your backups, and your first hour.

How does a ransomware attack work?

The sequence has barely changed, except that the theft now comes before the note.

• The way in. A phishing email, a stolen password, or an unpatched system. In lower education, Sophos found phishing was the most reported technical root cause in 2025, cited in 22% of cases.
• The quiet stretch. Attackers explore the network, look for backups, and copy data.
• The lockout. Files are encrypted and users are shut out.
• The note. The demand arrives, often with a threat to publish what was taken.

Better defense is working. Sophos found that the share of attacks on lower education stopped before encryption rose from 14% to 67%. That is a survey across 17 countries, not a U.S. figure, and it shows what prepared teams can do.

Why are schools still targets?

Schools hold sensitive data, cannot afford to shut down, and run on small teams. CIS reports that 66% of districts have just one or two people responsible for cybersecurity. In its survey of 426 K-12 technology and cybersecurity leaders, 56% called their programs underfunded and 70% said they had delayed cybersecurity projects, technology investments, or staffing because of budget issues, K-12 Dive reported.

Federal help also shifted. Federal funding for MS-ISAC ended in 2025, and it moved to a paid membership model, Cybersecurity Dive reported. Some states now buy statewide coverage, as Vermont did for its K-12 public schools. Ask your state what you can still get at no cost.

K-12 cybersecurity readiness, surveyed schools and districts

What should every school do before an attack?

When I first wrote about this, I talked with two of our top IT support technicians. Jason T. told me you need a multi-layered security approach, because it is not a one-size-fits-all situation. William P. said his number one recommendation was weekly sweeps to keep every connected device up to date and scanned. That advice has aged well. CISA's K-12 Cybersecurity Foundations package, for leaders as well as IT staff, now gives you eight objectives, including protecting login credentials and testing backups. K12 SIX updated its free Essential Cybersecurity Protections series in 2026.

The "3-2-1" backup policy Jason recommended still anchors this: three copies of your data, on two types of media, with one off-site. Add CISA's condition that backups must be offline, because many ransomware variants hunt for backups they can reach. And my own advice has not changed: if you are not sure, do not open or click. Call the person directly and ask if they sent it.

A plan nobody has practiced is a document, and a backup nobody has restored is a hope.Ernie Delgado, BeyondK12

Your ransomware incident plan in six steps

Print this. If the network is down, the plan on the shared drive is down with it. The steps follow CISA's #StopRansomware Guide.

1. Isolate. Identify affected systems and take them off the network, at the switch level if you can. Do not start wiping machines.
2. Move to a safe channel. Use phone calls and a pre-agreed contact list, so attackers do not learn what you know. Name one decision maker.
3. Call for help. Your cyber insurer, legal counsel, and IT partner first. Report to CISA at cisa.gov/report or to your local FBI field office or ic3.gov, and tell your state agency if your state requires it.
4. Preserve evidence and contain. Capture system images and logs from sample devices. Find the first point of entry. Ask law enforcement about possible decryptors.
5. Communicate. Tell staff and families what you know, what you do not, and how school will run. Follow your breach notification requirements with counsel. Keep paper attendance and emergency contacts ready.
6. Restore and learn. Rebuild in priority order from offline backups, reset passwords only after the environment is clean, and write down what you would change.

Should you ever pay the ransom?

Plan on no. In their Medusa advisory, updated in August 2026, the FBI, CISA, and MS-ISAC say they do not encourage paying, because payment does not guarantee recovery, and it may fund more attacks. They ask victims to report either way. Treasury has said the U.S. government strongly discourages these payments. Paying can also raise sanctions questions, so it is a decision for counsel and law enforcement, never for a tired leader at 7 a.m.

Something most IT companies will not tell you, as Jason pointed out, is that there is no guarantee you get everything back. Sometimes you get back a huge stack of files with no names and no folders. Comparitech recorded no confirmed payments in the third quarter of 2026, and five organizations said they did not meet the demands.

Where to start this week

Do two things. Ask your tech lead to restore one real file from backup while you watch. Then put the tabletop exercise on the calendar. You will sleep better knowing you have prepared, and if that day comes, you will have a plan your people have already used.

Your staff are the first line of defense, so make phishing practice part of professional development. If your school is adding AI tools, each is another account and another vendor to secure. The free AI Readiness Assessment scores your Guardrails, along with Policy, People, Curriculum, and Funding, in five minutes.

Related reading: The role of AI ethics and human judgment in protecting student data in schools and Top 3 markers to audit your school's AI readiness in one hour.

Questions school leaders ask

Should a school pay a ransomware demand?+

The FBI, CISA, and MS-ISAC do not encourage paying, because payment does not guarantee files will be recovered and may fund more attacks. Treasury has also warned about sanctions risk. Decide with counsel, your insurer, and law enforcement, and report the attack whether or not you pay.

Who do we call first in a ransomware attack?+

Follow your plan: your tech lead, your leader in charge, then your cyber insurer and legal counsel. Report to CISA at cisa.gov/report or 1-844-729-2472, and to your local FBI field office or ic3.gov. Use phones or personal devices, because school email may be compromised.

How much does a ransomware attack cost a school?+

Sophos's 2025 global survey put lower education's mean recovery cost, not counting ransom, at $2.20 million, the highest of any sector surveyed. Comparitech's median education ransom demand was $510,000 in the third quarter of 2026. Your costs will depend on size and how fast you recover.

Are ransomware attacks on schools going down?+

The trend is uneven. Comparitech recorded a 26% decline in K-12 attacks worldwide in the first half of 2026 compared with the half before, then a 24% rise from the second quarter to the third, from 25 to 31. Counts are provisional, and one quiet quarter is not a reason to wait.

Is MS-ISAC still free for schools?+

Federal funding for MS-ISAC ended in 2025 and it moved to a paid model, according to Cybersecurity Dive. Some states now buy statewide coverage: Vermont's includes K-12 public schools, GovTech reported. Ask your state education agency or cybersecurity office what is covered.

Do private and Catholic schools face the same risk?+

Ransomware does not check how a school is governed. Use CISA's K-12 Cybersecurity Foundations guides and the K12 SIX Essentials series. Check your insurance policy and your state's breach notification law with counsel.

Sources

1. Route Fifty, More than half of schools suffered a cyber incident in the past year (November 2026) (opens in a new tab) (checked 2026-11-05)
2. Center for Internet Security and MS-ISAC, The State of K-12 Cybersecurity 2026 (October 2026) (opens in a new tab) (checked 2026-11-05)
3. K-12 Dive, Cybersecurity incidents hit over 50% of schools and districts in past year (October 2026) (opens in a new tab) (checked 2026-11-05)
4. Comparitech, Education ransomware roundup Q3 2026 (October 2026) (opens in a new tab) (checked 2026-11-05)
5. Comparitech, Education ransomware roundup H1 2026 (July 2026) (opens in a new tab) (checked 2026-11-05)
6. K-12 Dive, Ransomware attacks against education sector slow worldwide (Comparitech, February 2026) (opens in a new tab) (checked 2026-11-05)
7. GovTech, Ransomware attacks on K-12 trend down, higher ed trend up in 2026 (August 2026) (opens in a new tab) (checked 2026-11-05)
8. Sophos, The State of Ransomware in Education 2025 (opens in a new tab) (checked 2026-11-05)
9. CISA, FBI, and MS-ISAC, #StopRansomware: Medusa Ransomware, AA25-071A (updated August 2026) (opens in a new tab) (checked 2026-11-05)
10. CISA, #StopRansomware Guide (opens in a new tab) (checked 2026-11-05)
11. CISA, K-12 Cybersecurity Foundations Resource Package (opens in a new tab) (checked 2026-11-05)
12. Maine Department of Education, New cybersecurity resources for schools and districts (August 2026) (opens in a new tab) (checked 2026-11-05)
13. K12 SIX, The K12 SIX Essentials Series (2026 updates) (opens in a new tab) (checked 2026-11-05)
14. Cybersecurity Dive, MS-ISAC loses federal funding (October 2025) (opens in a new tab) (checked 2026-11-05)
15. GovTech, Vermont becomes 13th state to purchase MS-ISAC membership (April 2026) (opens in a new tab) (checked 2026-11-05)
16. U.S. Department of the Treasury, Treasury takes robust actions to counter ransomware (September 2021) (opens in a new tab) (checked 2026-11-05)
17. U.S. Chamber of Commerce, The 3-2-1 backup rule (October 2025) (opens in a new tab) (checked 2026-11-05)

EDErnie DelgadoFounder and CEO of BeyondK12. 35 years in education technology, founder of Beyond Technology Education in 2001, host of the BeyondK12 podcast.About BeyondK12