● SAFER CYBERSPACE ESTONIAN SCHOOLS should prioritise cybersecurity In Estonia, cybersecurity requirements apply to nearly 1,000 educational institutions, ranging from local government-run kindergartens and schools to large public universities. However, the level of cybersecurity measures in schools varies widely, and the overall situation leaves much to be desired. T he Estonian Information System Authority (RIA) registers dozens of cyber incidents affecting educational institutions each year, most of which could be prevented with minimal effort. Schools face data breaches, account and website hijackings, scams, denial-of-service and ransomware attacks, and many other threats. Let us explore the most common risks and recommendations for avoiding them. DATA BREACHES AFFECTING STUDENTS AND STAFF Over the past few years, three cases in Estonia have involved the leakage of personal data from students and school staff, with at least one instance where the stolen data was put up for sale. These cases primarily involved contact and account information, which, while serious, are not the most sensitive types of data. However, schools may also handle highly sensitive information, such as students’ health-related data. For example, development plans for 44 children with special educational needs may include details of behavioural issues, health problems or even interactions with the police. If such information becomes public, it can severely damage a child’s future prospects. School healthcare workers also handle students’ health data, which is another potential vulnerability. One significant risk arises when a school nurse’s computer is connected to the same network as the rest of the school community (and anyone else with the password). To improve security, schools should segment their networks by creating separate sub-networks for different groups, such as teachers, students, administrative staff and medical personnel. Although this is not a particularly complex task, it is often overlooked due to a lack of awareness. Poorly secured school networks have even been exploited for criminal activities, including drug trafficking, leading to police involvement with affected schools. Cyber incidents jeopardise not only personal data but also the reputation of school staff and institutions. Repeated CYBER SECURITY IN ESTONIA 2025