Oliver Page
Email Threat Management
October 28, 2026
Reviewed by Jason Noel, former district IT leader at Metropolitan School District of Washington Township.
A staff member gets a Google Drive share notification: the superintendent has shared a file called "Updated payroll information." The notification comes from Google, the file leads to a fake login page, and in some cases the sender is a real account at another district. IT leaders in several states have described this lure to us in recent months. Once one person enters a password, the attacker has a trusted mailbox to send it from next.
The State of K-12 Cybersecurity 2026 report from CIS, the MS-ISAC, and CoSN names the pattern behind it: account takeover hopping, in which an attacker phishes one legitimate district account and uses it to phish that account's contacts, including staff at other districts. The report also documents attackers posing as superintendents from hijacked K-12 accounts to commit fraud. Account takeover is the thread running through the email threats facing K-12 now, including the most convincing business email compromise (BEC) and impersonation.
Phishing and email compromise top the list: 87% of K-12 IT and security leaders surveyed by CIS named them their most common incident. The threats behind those incidents are phishing, account takeover, business email compromise (BEC), and impersonation of district leaders or vendors.
Districts are attractive targets because they publish staff directories and board minutes, make large scheduled payments to vendors, and often run security with very small teams. That public information is also what makes spear-phishing work: an email written for one person can reference a real board agenda item, a construction project, or a payroll deadline. A successful spear-phish is often how an account takeover starts. For examples of the messages teachers and staff actually receive, see real-world phishing scenarios targeting K-12 educators.
Account takeover is spreading from one district to the next. According to the State of K-12 Cybersecurity 2026 report, the MS-ISAC told 808 of its 6,116 K-12 members last school year that staff accounts or credentials were circulating on underground and dark web marketplaces, and CIS assesses with high confidence that account takeover hopping will continue this school year.
In recent calls with K-12 IT leaders in several states, the same lure keeps coming up: a Google Drive share that appears to come from the superintendent, labeled as payroll information or a new staff document. In some cases it came from a real account at another district. The share notification itself is legitimate, so it carries few red flags, and one district told us its email security service wasn't catching all of them. Blocking outside shares isn't realistic when districts exchange files with neighboring districts and families every day.
The attack spreads because districts trust each other. Staff share files and messages with neighboring districts, regional service centers, and state agencies, so an email from a real account at another district gets far less scrutiny than one from a stranger. That is why the first hours after a compromise matter: the account needs to be locked, copies of the lure need to come out of every inbox, and nearby districts need a warning.
In a school district, BEC usually lands in the business office: someone posing as a vendor or leader asks payroll or accounts payable to send money or change where it goes. The attacker may use a look-alike address or a real account they have taken over.
BEC works because it looks like ordinary district business. There is often no link to click and no attachment to scan, just a believable request at a believable moment, so the email often passes through spam and security filters untouched.
Vendor payment fraud is the version that goes after a district's largest payments. The attacker impersonates a known contractor, supplies new banking details, and redirects a scheduled payment to an account they control. The strongest control is a verification call to the vendor, using a number already on file, before any banking change takes effect.
The hardest BEC attacks to spot come from a real district account that an attacker has taken over. The sender is genuine, the message passes authentication, and staff have little reason to question it.
In late 2023, a mid-level administrator at a medium-sized school district was targeted with a spear-phishing email that gave attackers access to district email. They combed the mailbox for vendor messages, doctored one, and sent it from the administrator's real account to staff to route to finance, which set up a payment of about $1.4 million without the required verbal check with the vendor. The bank questioned the transfer before it went through.
In a 2023 case, attackers got into a senior school system official's email and read along as that official worked with vendors and city finance staff. They then posed as both sides and steered several payments, more than $6 million in total, into fraudulent accounts. The scheme came to light only when the district's bus contractor asked about a payment it never received, and about $3.6 million had been recovered when officials announced the theft. A compromised mailbox is also a data exposure, with costs that go beyond the stolen payment.
Impersonation borrows authority: the email claims to be the superintendent, a principal, HR, or a familiar vendor, and it asks for something fast. It relies on look-alike addresses, spoofed display names, or urgency that discourages verification.
K-12 versions include a "superintendent" asking a teacher to buy gift cards for a staff appreciation event, or a staff member asking payroll to update a direct deposit account before the next pay date. These messages work because school culture is collaborative and responsive: staff want to help leaders and colleagues, and they often handle requests between classes or meetings on a phone, where the full sender address is easy to miss. The safeguard is a rule districts can set and enforce: any request involving money, gift cards, credentials, or banking changes must be confirmed through a second channel, such as a phone call to a known number or an in-person check, before anyone acts.
Email filters are essential, but they are built to catch malicious links, attachments, and known bad senders. BEC and impersonation often contain none of those things, and a message from a hijacked district account arrives over an authenticated path, from a sender the filter already trusts.
That puts weight on the people who see the message first. Staff who report a suspicious request quickly give IT the chance to pull every copy before anyone else acts on it. Building a staff reporting culture explains how districts get there, and why training alone isn't enough makes the case for pairing training with threat removal. Filters, training, and removal work best when a district plans them as layers rather than as separate purchases.
Three things stop these attacks: payment processes that make fraud hard to finish, staff who report fast, and an IT team that can pull a message from every inbox.
Districts also need a written plan for the moment an attack gets through, covering who suspends accounts, who contacts the bank, and who notifies other districts. To see how exposed your staff are today, measure your district's phishing click rate with a free assessment.
Yes, if the district's tools support it. Look for detection that recognizes phishing sent from inside the district and an option to suspend the account the moment it is flagged, with exceptions for critical admin accounts.
It should. A reported threat rarely lands in just one inbox, so look for removal that searches the whole district for copies, including ones no one reported, rather than cleaning up one mailbox at a time.
Multi-factor authentication makes account takeover much harder, which reduces the risk of the most convincing form of BEC. It does not stop vendor impersonation from outside look-alike accounts, because those attacks never log into a district account, and it can't help when the vendor's own mailbox is the one compromised. Verification procedures and staff awareness cover that gap.
BEC, impersonation, and account takeover succeed by turning routine district business into an opening, and the defenses that work are equally routine. For the full picture, see the guide to email threat management for school districts.
CyberNut is built for K-12 from the ground up, combining phishing simulations, microtraining that takes under 60 seconds, and district-wide threat removal in one platform trusted by 700+ school districts.
Run Your Free Phishing Assessment. Takes 15 minutes. No commitment.
Oliver Page
Some more Insights
Back
