Threats and risks for digital security in the educational environment

The digital transformation of education brings many benefits—from improved accessibility of content to personalised learning—but it also entails a range of security challenges that can jeopardise system integrity, student privacy, and the reliability of the educational process. Schools, universities, and other educational institutions often lack sufficient resources or expertise to adequately address the growing threats in the digital environment. Educational institutions typically operate multiple interconnected components of information systems, which further increases the complexity of implementing effective security mechanisms.

The main challenges facing the education sector today include:

1. Technologically outdated equipment

Many educational institutions use certain components of outdated equipment that no longer receive security updates, making them vulnerable to already known attacks. In addition, schools often lack specialised IT teams capable of performing systematic maintenance and security upgrades.

Example: 

The Stanford University School of Medicine experienced a data breach as part of a cybersecurity incident related to a third-party file-sharing service known as the File Transfer Appliance (FTA), provided by Accellion Inc.: Statement on the School of Medicine Cybersecurity Incident.
Read more about the incident at link.

2. Weak protection of personal data

In schools and universities, sensitive personal data are collected on a daily basis—such as names, addresses, personal identification numbers, grades, medical information, and even biometric records (e.g., in attendance tracking systems). These data are often stored without encryption, on unsecured servers, or shared with third parties without a clear legal basis. (Common Pitfalls in School Data Protection and How to Avoid Them)

Under GDPR, schools are required to protect the personal data of their students, and violations can result in significant fines.

More information: Croatian Personal Data Protection Agency website offers guides and educational materials on personal data protection

3. Phishing and Social Engineering

Phishing campaigns target teachers, students, and parents via email or messages, attempting to trick them into clicking malicious links or revealing their login credentials. Younger users and employees who are not educated about basic types of fraud can easily become victims of such attacks.

Advice: Introducing mandatory training on recognising fraudulent messages can significantly reduce the number of successful attacks.

Short educational video: What is Phishing? 

4. Insufficient Access Control

Student and teacher accounts are often created without appropriate security settings. Weak passwords, the reuse of the same passwords across multiple services, and the absence of multi-factor authentication (MFA) open the door to unauthorised access to school platforms and data.

Solution: Implement a policy requiring strong passwords and MFA for all system users.

5. Reliance on Third-Party Online Tools

Platforms such as Google Workspace for Education, Microsoft Teams, Zoom, and various LMS systems (such as Moodle) process vast amounts of user data. Although most of these tools have strong security mechanisms, their privacy practices and data usage may not always be fully aligned with the national legislation.

It is crucial to carefully review the terms of use and ensure that data are not used for commercial purposes.

Europe PMC Cybersecurity threats to educational institutions: growing concerns for a new era of cybersecurity

Conclusion

The main digital security challenges in education arise from a combination of technical vulnerabilities, insufficient user education, and unclear rules regarding data usage. Addressing these challenges requires a systematic approach that includes technological solutions, legal guidelines, and continuous education of all participants in the educational process.