Threat Spotlight: Spear-phishing attacks targeting education sector

As many schools and colleges continue to be remote, they rely heavily on email to receive updates from teachers, principals, and heads of departments. Hackers understand this and are taking advantage of the situation. From June through September 2020, Barracuda researchers evaluated over 3.5 million spear-phishing attacks, including attacks against more than 1,000 educational institutions such as schools, colleges, and universities.

- Mike Flouton

Barracuda researchers found that educational institutions are more than twice as likely to be targeted by a business email compromise (BEC) attacks than an average organization. In fact, more than 1 in 4 spear-phishing attacks that we saw targeting the education sector was a carefully crafted BEC attack.

Recent high-profile BEC attacks targeting schools and colleges demonstrate the devastating costs of this kind of attack:

• Manor Independent School District in Texas reported that a seemingly normal school-vendor transaction resulted in a loss of $2.3 million.

• Scammers used a fraudulent email to steal $3.7 million from Scott County Schools in Kentucky.

Here’s a closer look at the trends Barracuda researchers found in the ways cybercriminals are targeting schools, as well as solutions that organizations can use to defend against these attacks.

Highlighted Threat

Spear-phishing attacks targeting schools: Spear phishing is a personalized phishing attack that targets a specific organization or individual, and cybercriminals are constantly adapting how they use these attacks against different industries, such as education. Barracuda Research shows that, overall, cybercriminals targeted organizations evenly throughout the summer months, with an increase in the number of attacks in September. In comparison, there was a significant drop-off in spear-phishing attacks against the education sector in July and August when schools were closed for summer break. These months saw a drop of 10% to 14% below average, and the number of attacks picked up substantially in September when students returned