Nearly 82% American schools have experienced a cyberattack. What about your child's online lessons?

In March 2025, the US Cybersecurity Center published a report that is still being discussed in the educational community. Over eighteen months of research, four and a half thousand American schools provided their data. The results were alarming. Eighty-two percent of them had experienced cyberattacks. These are not abstract risks on paper. They represent nearly fourteen thousand recorded incidents and nine thousand three hundred confirmed breaches.

And as we write this article at the end of April 2026, the situation continues to worsen. Industry experts are already predicting that 2026 will bring a wave of AI-powered attacks. One in four US school districts reports an increase in attempts to hack student accounts. And only five percent of schools have two-factor authentication enabled for students.

This is the background against which parents have to decide where their child will study online. Not only in primary school, but also in extracurricular activities. In courses, tutoring, and online schools for various subjects. The question is simple. If public schools with their budgets, IT departments, and security are struggling, then how are small online services, where parents send their children for music, math, and Russian language lessons, faring?

At Palme School, we've been working online since 2016. During this time, digital security has transformed from a technical detail into a key factor for our parents when choosing a school. Let's explore what's currently happening and what to pay attention to when a child studies through a screen.

What exactly is being hacked in American schools

When people talk about a «cyberattack on a school,» many imagine a hacker in a hoodie rummaging through financial documents. The reality is different. In 2025, 82 percent of schools reported various types of incidents, and most of them don't start with a technical hack but with tricking a person.

The main tool of scammers is phishing. Emails that look like messages from an administrator, from a textbook platform, from Google or Microsoft. An employee or child clicks on a link, enters a login and password, and their account is already with attackers. According to the same report, human factor attacks exceed technical hacks by 45 percent.

The second popular scenario is data theft through third-party vendors. A school has a contractor who creates electronic grade books, digital textbooks, or bus routes. The contractor is hacked. Student data from dozens of school districts is leaked through them simultaneously. This is exactly what happened in Chicago and Los Angeles in 2023 and 2024.

The third type is ransomware. Hackers encrypt all of the school's files and demand a ransom. The school cannot hold classes, the cafeteria doesn't operate, and buses don't run their routes. According to industry reviews, recovery from such an attack takes from two to nine months, and the loss of instructional hours ranges from three days to three weeks.

What exactly is being leaked? Malicious actors gain access to a child's almost complete digital profile: first and last name, date and place of birth, place of residence, SSN, medical records, report cards, test results, and disciplinary notes. This compilation is then resold on underground marketplaces, used for fraudulent schemes involving credit products, loans are opened in teenagers' names, and parents are targeted with sophisticated phishing attacks.

There's a point that's rarely brought to the forefront. Stolen school data works against a person for decades. Let's say someone's social security number is leaked at age ten. For the next eight years, it sits in criminal networks' databases. Then, the young person goes to college, applies for a student loan, and discovers they already have a bad credit score, which appeared through no fault of their own.

What did schools start doing in response

American schools didn't dismiss the statistics; they started to act. Throughout 2025, debates were held concurrently in sixteen state legislatures regarding 28 bills concerning the protection of educational institutions' digital infrastructure. Simultaneously, school districts and public libraries submitted applications to the Federal Communications Commission totaling over $3 billion. This funding was specifically requested to enhance cybersecurity.

The measures taken can be conveniently described in three blocks.

The first block concerns hardware and software. It includes updating traffic filtering systems, continuous analysis of unusual network activity, frequent backups of important data arrays, and enabling two-factor authentication for all employees without exception. Individual districts are going further and adopting the zero-trust concept. This means that any action in the system is verified each time, even if the user has already logged in a few minutes prior.

The second group is restricting access to platforms. Schools are reviewing lists of approved applications that students can use. Unreliable services are being disabled. Lists of EdTech products that have passed security checks are becoming shorter and stricter. Parents are being sent updated rules for digital etiquette.

The third group is education. Teachers, students, and parents are taught to recognize phishing, not to click on suspicious links, not to share passwords, and not to use the same password for all services. According to the Center for Internet Security itself, the human factor remains the main vulnerability, and therefore work is being done with people.

A separate major topic is teaching children digital hygiene themselves. The curricula include lessons on protecting personal data, safe behavior on social networks, and what can and cannot be posted. This is no longer an elective, but part of the mandatory program in many states.

Where in this picture are the online schools

That's a good question. Parents rarely ask it openly, but they always have it in mind. If a public school with a million-dollar budget isn't succeeding, how can a small one? online schools, who gives Russian or math lessons?

The answer depends on the school. And here's good news for parents who choose carefully. An online school doesn't have a huge IT infrastructure that needs to be protected. There are no servers with records for thousands of children. There are no contractors processing the personal data of dozens of districts. There is no outdated equipment bought ten years ago and never updated.

So, a small online school with well-established processes might have an even simpler risk profile than a large public school. But this is provided that the school is actually thinking about it, and not just using random tools.

Here's what we consider a basic set for any online school working with children in 2026.

Using only verified platforms for video lessons. Zoom, Google Meet, and Microsoft Teams are certified according to the FERPA and COPPA child data protection standards. They also require a minimum set of features for the teacher: access control, the right to remove a student from the lesson, and the ability to block screen recording by unauthorized individuals.

Individual password-protected links for each lesson or a waiting room. This means a random person won't join a lesson, even if the link falls into the wrong hands. No open «for the whole class» links for a week in advance.

Minimal collection of personal data from families. Schools should only request what is truly necessary to conduct classes: child's name, age, and time zone. No social security numbers, no home addresses, no parents' banking details (third-party processors are used for payment).

Storing lesson recordings in a secure cloud, available only on demand. A child or parent can request a recording of a missed class, and it will be available for a set period of time. Then it will be deleted. Recordings are not stored in a shared folder where outsiders could accidentally see them.

Policy for educators on working with messengers. Teachers do not write to children in private messengers. All communication goes through the school's official channels. Parents are always informed about the topics discussed with their child.

Regularly updating passwords and not being able to use the same password on different platforms. It's trivial, but this is precisely how most accounts in the US get compromised. One password, leaked on a forum ten years ago, continues to work on work email.

What do we do at Palme School

Let's talk separately about our school's approach, as parents often ask about this during the initial calls.

Our core principles are the same as we described above in the list. Proven platforms for video lessons, not random services. A minimal set of data that we request from the family, no excess information.

We are not making a marketing story out of this. It's simply part of the basic hygiene minimum. In 2026, if an online school cannot clearly explain how it protects children's data, it's a reason to consider whether you should enroll your child there.

Parent Checklist

If you're choosing an online school for your child or just want to check if everything is okay at the one they're already attending, there are a few simple questions. Ask the school them. Honest schools will answer without strain.

This is the minimum that makes sense to check. It's simple and worth going through before enrolling a child in any online school.

Why is this important in the long run

Digital security sounds like a boring technical topic until something happens to your family. Then it becomes the main topic for several months.

Child data stolen at seven or ten years old lives in the shadow infrastructure for decades. It is sold, resold, used for fraud, for creating fake identities, for attacks on adult family members. Cases have already been recorded in the U.S. where teenagers, the first time they tried to apply for a bank card, found out that there was already an outstanding loan in their name. They didn't take the money. It was simply that their data was stolen in childhood and used by someone else.

So the habit Responsibly choose the digital services your child uses, This isn't paranoia, it's a basic skill for modern parents. A school with a good reputation, transparent processes, and clear answers to uncomfortable questions isn't as rare as it seems. You just need to ask questions.

At Palme School, we are ready to answer such questions. The first two lessons at Palme School are free. This is a convenient opportunity not only to observe the teacher's work but also to ask how exactly we protect children's data.