A phishing email targeting employees of the New York City Department of Education (DOE) was detected by an 18-year-old student apprentice, Addison Wang, working in the DOE’s IT security office. The malicious email directed recipients to a potentially harmful website, posing a risk of credential theft, malware deployment, or unauthorized system access. While only eight employees received the email, none interacted with the link, preventing a breach or data compromise. The incident was swiftly contained through email system searches and monitoring. The attack targeted a public education infrastructure supporting over 1 million students and staff, where a successful breach could have exposed sensitive data (e.g., student records, employee credentials, or financial details). The DOE’s reliance on student apprentices for cybersecurity tasks also highlights potential vulnerabilities in workforce training and incident response protocols. Had employees clicked the link, the attack could have escalated to data exfiltration, ransomware deployment, or lateral movement within the DOE’s network, disrupting operations for schools citywide. The lack of clicks mitigated immediate harm, but the attempt underscores persistent threats to government-run educational systems.

The file transfer programme MOVEit was involved in a hack that, according to the New York City Department of Education, exposed the personal information of around 45,000 children. Social security numbers, birth dates, and some student ratings are among the data that has been compromised, according to officials, though the specific data breaches per student vary. According to officials, employee information was also impacted, however they did not specify how many employees were involved. According to officials, the hack has not yet resulted in the publication of any education department data, and this summer, the department will start notifying those who were affected.

New York City’s Department of Education accidentally sent an email that exposed 439 paraprofessionals' information. The Department of Education exposed exactly 439 names, first, last names, and Social Security numbers. They took immediate steps and offered identity theft protection. DOE revived its policies to ensure this does not happen again.