In late September, Spokane Public Schools took PowerSchool and its payroll system offline, and teachers went back to taking attendance on paper. A few weeks later, the district said it had reason to believe student and staff data had been compromised.
For a district serving roughly 29,000 PreK–12 students across 57 schools, that is a hard lesson. Cybersecurity is now a core operating function for public schools, not a side task for an overextended IT department. For most districts, the fastest way to close that gap is outsourced IT support backed by broader, ongoing IT management.
What happened at Spokane Public Schools
District officials learned of a network security incident on Sept. 20, 2026, and the IT team took several systems offline to contain it, according to The Spokesman-Review. Those included PowerSchool, which runs attendance, grading and special programs, and BusinessPlus, which runs payroll.
Recovery took more than a week. Teachers recorded attendance and grades by hand and re-entered them once PowerSchool returned, while families lost portal access in the meantime. A third-party forensic team, brought in by the district’s insurance carrier, began working out the full scope.
In early October, the district said it had reason to believe student and staff data were compromised. Separately, threat-intelligence firm SOCRadar reported that the ransomware group NightSpire listed the district as a claimed victim on Oct. 12, though the district has not named who was responsible.
The district plans to contact impacted individuals once details are verified, but it hasn’t confirmed how many people are affected. Josh Smith, CEO of BCA, a Spokane IT firm offering managed IT support services, expects the number to be large. With roughly 29,000 students and thousands of staff in the district’s systems, he estimates tens of thousands of records may have been taken, putting those families and employees at risk of identity theft and targeted phishing.
K-12 cybersecurity by the numbers
Spokane’s experience is typical, not exceptional: about half of U.S. schools and districts reported a cyber incident in the past year. The bigger problem is capacity, since most districts are defending thousands of accounts and devices with a handful of people.
| Data point | Figure | Source |
| Schools and districts reporting a cyber incident in the past 12 months | 51% | CIS, State of K-12 Cybersecurity 2026 |
| Schools and districts reporting impacts to school operations | 34% | CIS, 2026 |
| Districts with only one or two people responsible for cybersecurity | 66% | CIS, 2026 |
| Ed-tech leaders naming insufficient security staffing as a top barrier | 65% | CoSN, State of EdTech 2026 |
| Ed-tech leaders naming lack of a dedicated security budget as a top barrier | 65% | CoSN, 2026 |
| Leaders worried about new AI-enabled cyber threats | 98% | CoSN, 2026 |
| Average cost of ransomware downtime for a U.S. school or college | ~$550,000 per day | Comparitech |
| Average downtime after a school ransomware attack | 10.7 days | Comparitech |
The headline attack count is moving in the right direction. Comparitech found K-12 ransomware attacks fell 26% worldwide in the first half of 2026 compared with late 2025. But the staffing and budget figures have barely moved, and cybersecurity has now topped CoSN’s list of district technology priorities for eight straight years.
Why outsourced IT support closes the gap
The math is simple. When two-thirds of districts have only one or two people responsible for cybersecurity, there’s no one left for overnight alerts, monthly backup tests or reviewing which vendors can reach student records. An outsourced partner adds that depth without the district having to recruit and pay for a full security team.
The budget case is just as strong. With 65% of ed-tech leaders saying they have no dedicated security budget, a predictable monthly fee is easier to plan around than new salaries or an unplanned recovery bill.
Outsourcing doesn’t have to replace internal staff. Most districts do best with a co-managed model, where in-house IT keeps ownership of classrooms, devices and instructional tools, and the outside partner takes on the specialized, always-on work. Smith puts it this way:
“Outsourcing isn’t about replacing the district’s IT people. It’s about giving them a bench: someone watching alerts at 2 a.m., testing backups every month, and keeping a response plan that’s been rehearsed, not just written down.”
Where school cybersecurity is heading
Smith says the Spokane incident reflects a structural problem rather than a single mistake.
“What happened in Spokane isn’t a story about one bad click or one missing tool. It’s what happens when a district with thousands of devices and dozens of cloud apps is protected by a team that’s already stretched across help desk tickets, Chromebook repairs and network projects.”
Smith sees three shifts shaping the next few years for schools.
- Identity is the new perimeter. The 2024 PowerSchool breach began with a single compromised credential and ultimately exposed data on 62.4 million students and 9.5 million teachers across more than 6,500 districts.
- AI is making phishing harder to spot. Nearly every ed-tech leader in CoSN’s survey is worried about AI-enabled threats, and attackers already use it to write convincing, error-free messages.
- Vendor risk is district risk. Spokane has also had to notify families about a nationwide breach at Canvas, its learning management system, even though officials said they weren’t aware of sensitive data being exposed.
“Attackers are using AI to write emails that read like they came straight from the superintendent’s office. The next few years in school security will be decided by identity: who’s logging in, from where, and whether that login makes sense. That takes someone watching around the clock, not just a stronger firewall.”
What a resilient district IT program includes
Whoever does the work, these are the controls that separate a contained incident from a weeks-long outage. In a co-managed setup, the outside partner usually carries the always-on and specialist pieces.
| Control | What it protects against | Typical owner (co-managed) |
| Multi-factor authentication on all staff and admin accounts | Stolen or reused passwords | Shared |
| 24/7 monitoring and threat detection | Attacks that start overnight or on weekends | Outsourced partner |
| Patch and update management | Known flaws in servers, laptops and network gear | Outsourced partner |
| Offline backups with regular restore tests | Ransomware that encrypts or deletes data | Outsourced partner |
| Vendor and app access reviews | Breaches at platforms like student information systems | Shared |
| Network segmentation | One infected device spreading across the district | Outsourced partner |
| Staff phishing training | AI-written emails that impersonate leadership | District, with partner support |
| Written incident response plan and tabletop drills | Slow, improvised decisions during an attack | Shared |
The lesson for Spokane-area schools
Spokane Public Schools did several things right. It took systems offline quickly, brought in forensic specialists and committed to notifying the people affected. The harder question for every district in the region is what happens before the next incident, not after it.
The data points one way. Attacks are constant, recovery is slow and costly, and most districts don’t have the staff or the budget to cover security on their own. Pairing in-house IT with an experienced outside partner is the most direct way to protect student and staff data.
