In May 2017, the WannaCry ransomware devastated hospitals and care centers in the U.K.’s National Health Service – as well as a handful of other public and private agencies around Europe. This major cybersecurity event highlighted vulnerabilities in healthcare facilities around the world and demonstrated to black hat hackers where to find easy targets for malware and other cyberattacks.

While the healthcare industry has hardly learned its lessons about security, many cybercriminals are turning their attention to other opportunities – namely, schools. In October 2017, the U.S. Department of Education warned that school districts would soon suffer an onslaught of attacks, and they were right. Here’s a brief history of the recent cyberthreats to schools and what schools can do to stay safe and secure.

Cyber-Scary Stories of Attacks on Schools

It’s easy to ignore warnings of cyberthreats when such threats are vague, but many American schools have specific stories of successful cyberattacks. Around the country, school networks are shutting down, teachers and administrators are being harassed, and districts are paying exorbitant ransoms to regain access to invaluable student data. Here are some of the most jarring true stories of cyber attacks on schools in recent months:

One Montana school district shut down more than 30 schools for three days due to threatening messages received by students and staff. Hackers broke into the schools’ servers to access data on students and staff, using contact info to send the threats and demand a ransom. Rather than refuse the schools access to their data, the hacking group requested $150,000 in Bitcoin to destroy their copies — and to prevent unnecessary harm to students and staff. The district refused to pay the ransom, and the threatening messages continue today. Other schools in different areas have suffered similar attacks with similar results, and it is likely the hacking group will continue hitting unprotected districts.

A Miami-Dade school district suffered a DDoS attack whose goal was infiltrating government agencies through school systems. Distributed denial of service (DDoS) attacks interrupt service, preventing teachers, administrators, students and others from accessing necessary resources. The hacking group responsible for this attack stole data, but it was more eager for methods of slipping from schools into government systems, like voting systems. Fortunately, hackers failed to do this in Florida, but they might be more successful in other states.

Cybersecurity Solutions Schools Need

Because schools, like hospitals and businesses, are loaded with valuable data – to include student, employee and family member information, health information, financial information and testing information and grades – they will remain significant targets for cyberattack until they demonstrate strong defenses. Here are a few worthwhile security tips for school administrations concerned about looming cyber threats:

Segregate valuable information from vulnerable networks. It is irresponsible to trust students to be safe on school computers, so schools should separate student networks from administrative networks. It is also prudent to segregate the school’s Student Information System (SIS) from student and administrative networks, so successful infiltrations do not result in leaked data.

Update endpoint security. Schools should consider disconnecting as many systems as possible from the internet, including printers, cameras, televisions and similar IoT devices, to limit opportunities of attack. Remaining devices that must connect to the web should have top-tier endpoint security software, and that software should be kept up-to-date to avoid unnecessary vulnerabilities.

Train employees and students in awareness and hygiene. Schools know better than other institutions that knowledge is power. By mandating cybersecurity training, schools can increase the number of users capable of recognizing and avoiding online threats thereby reducing mistakes through which hackers can reach valuable data.

Maintain security policies and a response plan. Users who wantonly reject safe online behavior should be penalized according to a written and available security policy. Also included in that policy should be a specific incident response plan, so users know how to react immediately upon discovering a breach.

Like healthcare providers, few schools have responded appropriately to the U.S. Department of Education’s warning regarding an increase in education data breaches. While schools are suffering from dozens of other threats that are difficult to overcome, cybersecurity is a relatively easy and affordable fix that keeps students, staff and family safe. The sooner schools learn from the stories of other insecure schools, the sooner schools can fully support the safety and success of their students.