The cyberattack follows the school calendar.
The joint CISA, FBI, and MS-ISAC alert that became the reference on the topic recorded the pattern: in August and September, 57% of ransomware incidents reported to MS-ISAC involved K-12 schools, against 28% from January to July. Back to school opens doors: freshly configured networks, new devices distributed in a hurry, and lean IT teams under overload.
The 2026 map: the target moves, and Brazil runs against the tide
The current map shows the target in motion. In the first half of the year, attacks on K-12 schools fell 26% worldwide, according to Comparitech, and rose more than 8% in higher education.
In Brazil, the education sector recorded 8 disclosed attacks in the semester, up 33%, in a period when the global number was falling. The country stayed off the Latin American espionage campaigns list, but on the education ransomware map the local tide rises while the global one recedes: attackers go where defense is weakest, and here the weakness has an address.
The target’s profile: the worst of all worlds, assembled
School networks concentrate the combination ransomware looks for:
- The most lifelong data: minors’ data, protected by the best-interest rule and, once leaked, never coming back. Names, documents, addresses, and grades keep circulating whether the school pays or not.
- The tightest budget: security competes with meals, materials, and salaries.
- The frailest IT: outsourced, shared, or nonexistent.
- The most vulnerable backup: within the attacker’s reach, mounted on the administrative network.
Each item, alone, is manageable. Together, they are the definition of a preferred target.
The audit pattern that repeats
In the audits I run, the pattern in school networks repeats what I see across the market: hypervisor without MFA, backup reachable from the administrative network, and a response plan that was never tested.
It is the same tripod hypervisor ransomware exploits in the private sector, with a difference of scale: taking down a school’s hypervisor takes down enrollment, grades, and school meals on the same day. The institution’s entire operation depends on the layer almost nobody watches, and back-to-school season is when it is most exposed.
Brazil regulating while the season approaches
The Brazilian regulatory answer already exists: the LGPD handles children’s and teenagers’ data under the best-interest rule, and the ANPD made child and adolescent protection, with the Digital Child Statute, a 2026-2027 enforcement priority axis. The sanction precedent is public and has a number: R$ 153.7 million for teenager data.
And the calendar cuts in favor of preparation: back-to-school season has already passed on the other side of the world; ours starts in February. Those are months of window to enforce MFA, separate the backup, minimize minors’ data, and write the plan. In February, the attacker also goes back to school.
Conclusion
Whoever runs a school network should treat security as part of the curriculum: it is not an extra on top of the school’s mission, it is the condition for the mission to keep running on the Monday after an attack.
The measures that close the tripod (MFA, backup out of reach, a tested plan) require no new budget, only a decision. And the school calendar is public on our side and the attacker’s alike: October’s question is whether February finds the network ready or freshly configured in a hurry again.