In the past month, we have seen cybercriminals steal data from Florida’s Highway Safety and Motor Vehicles, a Louisiana-based identity verification company, and a healthcare company’s patient records. In addition to theft, there’s legal access: data gathered and sold by service providers, plus public records, all collected by companies called data brokers. We can pay companies to remove our data from these brokers, but once it reaches bad actors, it stays there permanently.
Several years ago, before the age of generative AI, it became commonplace for me to see co-workers at my school receive text messages, called smishing, asking them to take an out-of-band action related to their job. This has been an effective tactic because we have an isolated view of our data. “No one has my phone number” is a common lead concern. Then they jump to the conclusion that there must have been an incident at the school. It was an easy correlation. Early in these events, we spent hours checking all of our logs and systems. Nothing was ever found.
At the time, I already knew about Open Source Intelligence (OSINT). These attacks gave me a focal point for a deep dive into learning and investigation. Since I had a practical example in hand, I used it to do my research. Within two hours, I had identified legitimate sites that contained all the data used in the attack. I wrote up my findings, outlining exactly how the bad actors stitched the data together. In the meeting, we reviewed the data and realized just how easy, and how common, this attack would become.
Fast forward to the age of generative AI. The two hours of work I did a few years ago are done in minutes, and those minutes don’t produce one target, but hundreds or thousands. School districts are even more vulnerable to these attacks. All of our hiring is public by statute. We produce board minutes and human resources reports with the names of new hires. Take those names, search the legal and illegal data bad actors already have, and geo-fenced connections form fast. In the past three years, this has become so common that I warn every new hire in the business and HR departments that they’ll receive these and other novel attacks in their first 60 days.
What are we to do? First, we need to accept that due to data brokers, highly connected digital lives, and massive data breaches, our personal information is not private. We can no longer trust that our data is private. When we treat our data as private, it fosters trust in communication involving that “private” data. That trust is being exploited. We need to unlearn this inherent trust. Contacts we would have trusted in the past, based on their content alone, now need to be verified outside that contact. If you have a text about your bank, don’t reply, call, or check your account from another device. This is just another step toward becoming cyber-aware and protecting yourself and others.
Learning Technology Center (IL)
Bio: Will Brackett (he/him) serves as the Director of vCISO Services at the Learning Technology Center, where he helps Illinois school districts strengthen their cybersecurity posture through strategic planning, risk management, governance, and compliance.
With nearly 30 years of experience in K-12 education and educational technology, Will has held leadership roles spanning classroom instruction, information technology, and district administration. Before joining the LTC, he served as Director of Technology for Oak Park Elementary School District 97, where he led districtwide technology operations and cybersecurity initiatives.
Will is a recognized leader in K-12 cybersecurity and technology strategy. He serves as Co-Chair of the Cybersecurity Advisory Committee for the Consortium for School Networking (CoSN) and is a frequent presenter at state and national conferences on topics including cybersecurity, data privacy, technology leadership, and digital resilience.
At the LTC, Will partners with school leaders to develop practical, sustainable cybersecurity programs that align with each district’s goals and resources. His collaborative approach helps districts reduce risk, improve operational resilience, and build a culture of security across their organizations.
Published on: October 15, 2026
CoSN is vendor neutral and does not endorse products or services. Any mention of a specific solution is for contextual purposes.
