Dive Brief:

• A phishing scam used someone posing as the superintendent of the public schools in Groton, CT, via email, requesting information on W-2 forms for all 1,300 employees from the district’s business office, according to an Associated Press report.
• While the full details of a phishing attempt in nearby Glastonbury have not been released, the Associated Press reports there, too, employee names, addresses and social security numbers could have been exposed through a W-2 phishing scam.
• In Glastonbury, the personal information of 1,600 employees could have been stolen, with food service personnel being spared.

Dive Insight:

School districts carry a wealth of private information about a large number of employees as well as students, though the latter generally have personal information that isn’t tied to any kind of credit history or routinely monitored for identity theft. Hackers also know schools tend to spend less money protecting this data than major corporations, for example.

Districts have to take this threat seriously, and being proactive is better than being reactive. Experts say it is important to have clear policies and procedures in place for data protection as well as training for end users about how to keep their information safe. When it comes to ransomware, districts can avoid making payouts by continually backing up digital files and restoring them in the event of a hack rather than paying to decrypt them.