Stolen staff logins are spreading attacks between K-12 school districts

MS‑ISAC/CIS reports widespread credential exposure and active account‑takeover phishing across K‑12 school districts — 808 districts had staff credentials observed on underground markets, attackers use compromised accounts to phish contacts at other districts, and malware infections (notably via malicious ads) account for a large share of incidents; survey results show small security teams, frequent phishing incidents, and limited preparedness, and CIS recommends expanding MFA, monitoring exposed credentials, reviewing privileged accounts, and running tabletop/operational exercises.