York University has announced it suffered a cybersecurity incident in which a threat actor stole personal information people submitted through online forms. [...]

Frontline Education told Indiana regulators that its August data breach affected over 3 million school district staff and students.

The post Over 3 Million People Hit by Frontline Education Data Breach appeared first on SecurityWeek.

Hackers exploited a flaw in third-party software and stole the personal information of school district staff and students.

The post Frontline Education Data Breach Impacts Over 1.3 Million appeared first on SecurityWeek.

A 3AM ransomware affiliate targeted a school estate in the UK and successfully encrypted around 37 of nearly 50 machines reached from an unmanaged host. [...]

Google will disable AI tools by default for K-12 students early next year unless school administrators explicitly enable them, but schools that choose to block AI entirely will also lose student access to Google Search. The New York Times reports: Executives at the tech giant said they wanted to be responsive to educators and parents who have asked for more control in how children interact with A.I. But there is a catch: Schools that choose to restrict A.I. entirely will also lose access to Google search. A.I. features are now a standard part of Google's commercially available search engine. "Search and A.I. are deeply integrated," said Chris Phillips, vice president for education at Google. If a school has banned A.I., he added, students "will not have access to search, and they'll see a message from their school that indicates it's not available." [...] The company's new strategy underscores Google's powerful role in American education. If school leaders want continued student access to search within the company's ecosystem, they will be forced to embrace Google's A.I.

Read more of this story at Slashdot.

The Florida Department of Education says SSNs and other personal data may have been exposed in a breach of its financial aid website.

The post Florida Student Aid Website Hack Puts Data of 4.9 Million People at Risk appeared first on SecurityWeek.

Generative AI was recently banned in America's two largest school districts, just weeks after OpenAI launched ChatGPT for Teens. But forging ahead, tech-backed nonprofit Code.org — now renamed CodeAI — has named OpenAI the "Lead Partner" for its 2026 Hour of AI (which last year replaced its signature event, "the Hour of Code"). Long-time Slashdot reader theodp explains: In August, OpenAI announced a new signature partnership with CodeAI to "prepare the first AI generation", explaining that "through the Hour of AI, OpenAI and CodeAI will introduce millions of students to the basics of using AI thoughtfully and responsibly." The updated Hour of AI website also listed OpenAI's investor/partner Microsoft as one of two "supporters" for the Hour of AI. Now, Microsoft is calling all K-12 teachers around the globe to register for What's working now: Making AI literacy joyful for every learner, a November 17th Microsoft Teams webinar where it will unveil its Minecraft-branded "Hour of AI experience." "Discover how AI literacy can be engaging, approachable, and joyful for students... and hear practical ideas from educators bringing AI learning into their schools and classrooms." Speakers include a marketing lead for Microsoft's AI training initiative plus the head of marketing for Microsoft Minecraft Education.

Read more of this story at Slashdot.

The University of New Mexico Health Sciences Center disclosed a cyberattack that caused system outages and disrupted patient care and academic activities. [...]

The University of Copenhagen in Denmark confirmed that hackers accessed one of its test environments containing personal data belonging to 525,000 people. [...]

Intruders used compromised credentials to access an ETS SFTP server, copying records of California students back to 2006.

The post One Compromised Login Exposed Millions of California Students’ Records appeared first on SecurityWeek.

Millions of current and former students at California's public school have had their data stolen — including names, date of birth, and addresses — stolen in a breach, reports the Los Angeles Times. The breach affects students "who took the state's mandated standardized tests that annually assess their academic proficiency, education officials announced Friday." The compromised information affects many more than the state's current 5.7 million public-school students as the breach dates back to 2023 enrollments. Students who left California but did not confirm their transfer to another school also were affected, dating back to 2006. The data breach involved [nonprofit] Educational Testing Service or ETS, which provides extensive services to California [including test participation and assessment data]... Affected former students, including those who are now adults, are eligible for 24 months of free identity-protection services and identity-restoration help if there is identity theft. Officials said that parents and guardians may want to consider requesting a free credit freeze for their children who are under 16 to help prevent unauthorized accounts from being opened in the names of their children. The breach involved a compromised login credential, according to a web page about the incident from California's Department of Education. The compromised credential was then used to copy files with student information at "various" times between May 22 and September 18, 2026, which drew concern from a cybersecurity expert interviewed by the Los Angeles Times: "A stolen login credential should not become a months-long passport to millions of students' personal records," said Anton Dahbura, executive director of the Johns Hopkins University Information Security Institute. "If that is what happened here, the critical question is why authentication safeguards, access restrictions, and monitoring systems failed to detect and stop the unauthorized activity." He added: "Incidents like this expose a fundamental weakness in how we manage student data: School systems may outsource the storage and processing of sensitive information, but they cannot outsource the consequences of a breach. When millions of student records are concentrated with a single vendor, one security failure can become a statewide problem with consequences that follow children for years." A spokesperson for ETS told the Times that they've now implemented additional safeguards, including strengthened access controls, enhanced monitoring, and more third-party review of their security practices.

Read more of this story at Slashdot.

Parts 1 and 2 of this series looked at two pressures facing higher education security teams. First, the threat landscape: universities are dealing with more frequent attacks across complex, distributed environments, while campus-by-campus security can make it harder to share intelligence and coordinate response. Second, the compliance burden: overlapping requirements across FERPA, GLBA, HIPAA, and CMMC make it difficult to establish what data was affected, which reporting obligations apply, and how quickly the institution needs to act.

This final part is about what changes when a university system starts treating security as a shared capability rather than a collection of separate campus programs. Multi-campus institutions still need to preserve local autonomy, but they also need enough visibility across the wider organization to understand where risk sits, how an incident is spreading, and whether the same problem is appearing elsewhere.

That balance is especially relevant in higher education, where campuses, research environments, health services, and administrative teams often operate with very different technology needs and levels of independence.

Security architecture should reflect how universities actually operate

Most university systems are already federated organizations, with individual campuses managing their own leadership, budgets, users, and technology environments while a central office provides governance and oversight across the wider institution.

Security architecture can follow the same model. With multi-tenancy in the Rapid7 Command Platform, a central security team can maintain visibility across the university system while individual campuses continue to operate within their own environments. Campus-level data and access remain separated, while the central team can identify wider patterns, coordinate response, and distribute common workflows across the system.

A new attack pattern detected at one campus, for example, should not have to remain a local discovery. Shared visibility and coordinated workflows can help the central team determine whether the same activity is appearing elsewhere and make relevant response guidance available across the institution without exposing one campus's data to another.

As the university system grows, that model can expand with it. A system operating three campuses today can add new environments without redesigning the security architecture each time.

Shared visibility makes cross-campus response faster

A central view of the attack surface can reduce much of the manual work that happens when university teams need to answer a system-wide security question.

If a significant zero-day is disclosed, the central security team needs to know which campuses are running affected systems, which have already remediated the vulnerability, and where attention is still required. In a decentralized environment, gathering that information can mean emails, calls, spreadsheets, and separate conversations with each campus. A shared view of assets and vulnerabilities gives teams a faster way to establish where the exposure exists.

During an active incident, the same cross-campus visibility can help investigators work out whether suspicious activity first appeared at Campus C because the compromise began there, or because that is simply where it became visible. It also allows them to check whether the same indicators are present at Campus A or Campus B before each team starts investigating independently.

Universities also have large external attack surfaces that can be difficult to inventory centrally. Student portals, APIs, research servers, faculty websites, and other internet-facing assets may be created outside normal IT processes. Rapid7's Project Sonar continuously scans the public internet, helping organizations identify externally exposed services and assets that internal inventories may have missed.

Vulnerability prioritization needs more than a severity score

University security teams rarely have the capacity to remediate every vulnerability at once, so prioritization has to reflect how likely an exposure is to be used in a real attack.

Rapid7 combines vulnerability data with attacker intelligence, including insight from Metasploit, our open source penetration testing framework used by security professionals to test and validate real-world exploits, with more than 3,000 exploit modules.

That intelligence is combined with insight from AttackerKB, incident response engagements, honeypots, and other threat intelligence sources, giving teams additional context around whether an exploit exists, whether exploitation has been observed, and how difficult a vulnerability may be to use in practice.

For a university working through thousands of findings across multiple campuses, that context can help teams direct limited remediation capacity toward exposures with stronger evidence of attacker interest rather than relying on severity scores alone.

Incident response has to work across campus boundaries

The compliance requirements discussed in Part 2 put added pressure on investigation speed, particularly when legal or compliance teams need to establish whether regulated student, financial, health, or research data was accessed across more than one campus.

Rapid7's open source Velociraptor platform can collect forensic artifacts and run live investigations across thousands of endpoints simultaneously. In a multi-campus university, that could allow investigators to determine whether the same activity or data access occurred across several environments without conducting each investigation separately.

Automated response workflows can also be distributed across affected campus environments, allowing teams to isolate compromised systems, revoke credentials, or block indicators consistently rather than repeating the same response manually at each institution.

Campuses with smaller security teams benefit from that shared capability because the quality and speed of response are less dependent on how many people happen to be available locally when an incident occurs.

Consolidation can return time to stretched security teams

The operational case for a shared security model also comes down to the amount of work created by fragmentation. Separate campus tools mean separate licenses, integrations, training requirements, renewals, reporting processes, and vendor relationships, all of which consume time that understaffed security teams could be spending elsewhere.

The source material for this series includes an example of one organization recovering 96 hours per month by reducing manual work across disparate security tools. It also cites an average 74% improvement in mean time to detect where unified visibility and threat correlation were applied. For higher education teams working within tight regulatory reporting windows, the difference between finding an incident in hours rather than days can have a direct impact on how quickly the institution can assess scope and respond.

A system-wide agreement can also reduce the number of contracts, renewal cycles, and vendor relationships that central and campus teams need to manage, while allowing security capabilities to scale as the institution adds campuses, devices, and cloud services.

Building security around the university as a whole

Multi-campus universities will always have different technology needs across individual campuses, research environments, health services, and administrative functions. A connected security model does not require those environments to operate identically, but it does give central and local teams a better way to understand shared risk, coordinate investigations, and apply consistent response when an issue extends beyond a single campus.

Across this series, the same pattern has appeared from different angles. Threats move across organizational boundaries, regulated data rarely sits neatly within one campus, and the people responsible for protecting university systems are already working with limited time and resources. Bringing more of that security context together can help teams respond faster, share intelligence more effectively, and reduce the manual work created by disconnected tools and processes.

Rapid7 helps more than 11,000 organizations worldwide take command of their security. Learn more at rapid7.com/sled.

An anonymous reader quotes a report from Ars Technica: Schools and libraries from around the U.S. pleaded with the Federal Communications Commission to drop the idea of ending E-Rate, a $2 billion-a-year program that connects students and library visitors to the Internet. FCC Chairman Brendan Carr has criticized school districts for having "experimented with a massive increase in screen time for students," and said E-Rate expanded too far beyond its original purpose of "supporting basic Internet access to schools and libraries for educational purposes." In June, Carr led a 2-1 vote to issue a Notice of Proposed Rulemaking (NPRM) seeking public comment on whether E-Rate should be "limited or sunset to reflect today's extensive connectivity rates." Carr's proposal could result in E-Rate cutting the discounts that schools and libraries receive for telecom services and equipment, and imposing more restrictions on how E-Rate money can be used. The FCC seeking comment on whether to sunset the program also raises the possibility that Carr might choose to axe E-Rate entirely. The National Association of Elementary School Principals told the FCC that it "strongly supports the continued operation of the E-Rate program and urges the Commission to reject proposals that would eliminate, substantially restrict, or impose new conditions on this essential source of connectivity assistance for schools and libraries." The Carr FCC already scaled E-Rate back last year by ending funding for schools and libraries to lend out Wi-Fi hotspots and for Wi-Fi service on school buses. "Importantly, the FCC does not have the authority to terminate the E-Rate program. The E-Rate program is mandated by Congress, and the FCC is responsible for administering it," the American Library Associated told the FCC. The American Library Association said "the FCC lacks the authority and expertise to regulate screen time or determine educational outcomes." In a filing, the group pointed out that under U.S. law, determinations about what content is inappropriate for children "shall be made by the school board, local educational agency, library, or other authority responsible for making the determination."

Read more of this story at Slashdot.

The Chicago Sun-Times reports: When Elgin Community College hired Flock Safety to install six surveillance cameras in April 2025, President Peggy Heinrich thought they would "enhance the safety and security of students...." They were supposed to help locate stolen cars and missing people. But Heinrich started to wonder if the cameras were actually making students less safe after seeing news reports that data captured by Flock cameras in Illinois had been shared with U.S. Customs and Border Protection. Then in September 2025, Immigration and Customs Enforcement detained an Elgin Community College student in a campus parking lot. More than half of students at the far west suburban Chicago campus identify as Latino. Heinrich said enrollment dipped. Students were afraid to come to class. College officials decided the cameras had to go... College officials asked Flock to remove the surveillance cameras "out of an abundance of caution for our students," Heinrich said. But getting the cameras taken down was not as simple as it sounds, especially because Flock retains ownership of the company's equipment.... Surveillance experts say the company is financially incentivized to have as many cameras gathering data as possible even in places that no longer want them, because potential clients are looking for the surveillance network with the greatest reach.... Elgin Community College staff notified Flock in October 2025 that they wanted to cancel their contract and have the cameras taken down. Within a day, Heinrich said, Flock rejected the request and refused to uninstall the equipment on the basis that the company had not breached their agreement. College officials reached out again in December 2025 and said they would pay for the remaining five months of the contract — they just wanted the cameras taken down. "We never received a response back from Flock," Heinrich said. That's when things got weird. Heinrich said Elgin Community College staff began to cover the cameras using black trash bags and zip ties so that they would not be able to capture footage. But workers in an unmarked vehicle, which Heinrich assumed belonged to Flock, repeatedly removed the coverings... This strange dance continued, Heinrich said, until Elgin Community College's contract with Flock expired in April this year and the company uninstalled the cameras for good.

Read more of this story at Slashdot.

In Part 1 of this series, we looked at the security challenges created by fragmented, campus-by-campus environments. Higher education also faces a second pressure that makes that fragmentation harder to sustain: overlapping compliance obligations across FERPA, GLBA, HIPAA, and CMMC.

Each framework brings different requirements, reporting timelines, and consequences for failure. Managing them across one institution is already complex, but across a multi-campus university system with separate tools, staff, data stores, and governance practices, it becomes much harder to establish what happened, what data was involved, and which reporting requirements apply. With universities already facing an average of 4,388 cyberattacks per organization per week, according to the figures cited in Part 1, that regulatory complexity is becoming an operational security problem as much as a compliance one.

FERPA puts universities on a 24-hour clock

The Family Educational Rights and Privacy Act has governed the privacy of student education records since 1974, but the pressure on security teams becomes much more immediate when financial aid information is involved. If a breach compromises that data, institutions must notify the Department of Education’s Federal Student Aid office within 24 hours of discovery, leaving very little time to establish the scope of an incident while the response is still underway.

A ransomware attack discovered at 9 PM on a Friday makes the challenge easier to picture. By 9 PM Saturday, the institution may need to determine whether financial aid data was involved, understand which systems and students were affected, coordinate with legal teams, and prepare regulatory notification, all while investigators are still containing the incident and establishing what else the attackers accessed. In a multi-campus environment, that gets harder when financial aid data is spread across separate systems or when the initial discovery happens well after the compromise began.

GLBA brings financial-sector obligations into higher education

Universities may not look like traditional financial institutions, but their role in student lending and financial aid brings them within the scope of the Gramm-Leach-Bliley Act’s Safeguards Rule. Covered institutions are expected to maintain a written information security program addressing areas including risk assessment, access controls, encryption, multi-factor authentication, incident response, and vendor oversight.

Reporting requirements can add further pressure. If a security event affects 500 or more consumers, the draft notes that institutions must notify federal law enforcement immediately after discovering the breach. In a university environment, where shared financial aid systems may contain records belonging to thousands of students across multiple campuses, that threshold can be reached quickly.

The multi-campus structure matters here because financial aid data rarely follows neat organizational boundaries. Students transfer between campuses, shared services may centralize information, and one system may support several institutions. A breach that begins at one campus can therefore create obligations for the wider university system, making it important to understand the scope of the incident beyond the environment where it was first detected.

HIPAA reaches well beyond the university hospital

Protected health information can exist across a much wider university environment than the hospital alone. Student health centers, counseling services, physical therapy programs, and research projects involving human subjects may all create, receive, transmit, or maintain health data, sometimes through systems that have been procured and managed separately from central IT.

A mid-sized university with a health clinic, counseling center, physical therapy program, and clinical research lab, for example, could be handling significant volumes of PHI across several independently managed environments. If one of those systems is compromised, the security team needs to establish quickly whether health information was involved and how far the incident spread.

Under the requirements set out in the draft, breaches affecting 500 or more individuals must be reported to the Department of Health and Human Services within 60 days of discovery, while some incidents also trigger media notification requirements. For universities operating across several states or with online programs, the picture becomes more complicated again. Without a reliable view of where PHI resides across the institution, determining whether those reporting obligations have been triggered can itself become part of the incident response challenge.

CMMC raises the stakes for university research

CMMC creates a different kind of pressure for institutions conducting Department of Defense-funded research or handling Controlled Unclassified Information. Research computing environments are often among the most decentralized parts of a university: individual labs build their own systems, principal investigators make independent technology decisions, and networks can evolve over years without the consistency found in centrally managed administrative IT.

CMMC Level 2 requires organizations to demonstrate implementation of 110 security practices drawn from NIST 800-171. Meeting those requirements across a diverse research estate can be difficult without limiting the flexibility researchers need to conduct their work. For institutions that rely heavily on federal research funding, the consequences also extend beyond a conventional compliance penalty because failure to meet CMMC requirements can affect contract eligibility.

One incident can trigger several compliance obligations

The real operational difficulty appears when several of these frameworks apply to the same incident. A large research university may operate student financial aid systems, health services, a hospital, and DoD-funded research environments, creating the possibility that FERPA, GLBA, HIPAA, and CMMC obligations all come into play during one investigation.

Imagine ransomware is first detected on a shared administrative system. As the investigation develops, the compromised account is found to have accessed financial aid records, student health information, and a research environment containing CUI. The university now has to understand several categories of regulated data, determine which reporting thresholds have been met, coordinate with different agencies, and maintain the evidence required for each process while still responding to the attack.

That is difficult even with centralized visibility. When security data, incident records, and compliance evidence sit across different campus tools and teams, building a reliable picture of the incident takes longer and introduces more opportunities for information to be missed.

Preparing for compliance across a multi-campus system

Meeting overlapping compliance requirements depends on being able to answer a relatively small set of questions quickly: where regulated data lives, whether it was affected, how the attacker reached it, and what happened next. University systems need enough shared visibility across campuses to answer those questions without reconstructing the entire incident manually every time something happens.

That includes consistent data classification, centralized access to security and compliance evidence, and incident response processes that have already been tested against the reporting windows institutions may face. Automation can also help teams establish the scope and context of an incident more quickly, particularly where reporting deadlines are measured in hours rather than days.

The aim is to preserve the autonomy individual campuses and research environments require while giving the wider university system enough visibility and coordination to respond consistently when regulated data is involved. As the number of overlapping obligations grows, fragmented security becomes harder to separate from compliance risk.

In Part 3 of this series, we’ll look at how a consolidated security architecture can support that model across multiple campuses, from shared visibility and threat intelligence to more coordinated detection and response.

Rapid7 helps more than 11,000 organizations worldwide take command of their security. Learn more at rapid7.com/sled.

Longtime Slashdot submitter theodp writes: GeekWire reports that the University of Washington has moved its Global Innovation Exchange {GIX) program to Microsoft's campus in a rent-free deal (UW News release). GIX, an institute supporting tech leaders that offers an MS in Technology Innovation, is the first UW program to set up full-time operations at Microsoft, whose headquarters are just across Lake Washington from the university's main campus. Microsoft provided a $42 million in-kind donation to establish the embedded facility; the UW is leasing the new 48,500-square-foot GIX space in Microsoft's Building 92 rent-free. GIX debuted in 2015 as a partnership of the UW and China's Tsinghua University and received $70 million in Microsoft support at the now-abandoned GIX location in Bellevue (the Steve Ballmer Building), although indications are that a long-term arrangement did not come together as intended. In a Thursday LinkedIn post, Microsoft President Brad Smith wrote: "Last night we opened a door unlike any other. At the heart of Microsoft's campus, step into the new home of the UW's Global Innovation Exchange (GIX) and you cross from Microsoft into the University of Washington. No one has ever put a great research university and a leading technology company under the same roof quite like this. As far as I know, no one has even tried. The timing matters. Artificial intelligence is advancing fast. The question is whether the people building it understand the world it's changing. This calls for a new style of education and leadership. We need leaders who understand the technology deeply and see things through other people's eyes. Leaders who learn by collaborating on real projects with people from different countries and disciplines. That's what GIX is built for. Students will learn from faculty across the UW, take classes taught by Microsoft employees, and be mentored by people from across our industry here in the Pacific Northwest." Interestingly, Smith's contention that UW GIX students will benefit from a 'new style' of Microsoft and industry-influenced education sounds a lot like Smith's contention that K-12 school children are better off thanks to a new style of Microsoft and industry-influenced education. In an interview last month, Coding Kids: Big Tech's Battle to Remake Public Schools author Natasha Singer told NPR (podcast, transcript), "For my book, I spoke to Brad Smith, who's the president of Microsoft, and he has been one of the leaders in the tech industry pushing for [K-12] computer science [and now AI literacy] in schools. [...] And Brad Smith said, philanthropy in the private sector is doing this work because public schools have failed to do what they were supposed to do. And his view is that public schools should be teaching modern subjects like computer science, and they were not equipped to do it fast enough and the tech industry stepped in to help. And is it better than if schools were able to do this themselves? He said, no, but it's certainly better than nothing. And he said to me, you know, think about where we would be on computer science if the tech industry hadn't stepped up. [...] Well, I've been having this conversation with him for 10 years, and when we started having it 10 years ago, I said to him, I get that, but when big tech companies put their finger on the scale, it tips education in certain ways that not only favor the tech industry but can obscure equally or more important things." So, is "The University of Washington at Microsoft" a good or bad idea?

Read more of this story at Slashdot.

On academic mentoring platform Nova Learning, Computer Science and AI, "once the dominant choice among students... is losing ground fast, while Engineering has nearly doubled its share." It's a small survey, but "The steepest proportional decline is in Software & Data Science, the most traditional 'learn to code' pathway, which lost 44% of its 2025 share. AI saw the largest absolute drop of any single subject in the survey, down 6.2 points. "The category did not decline uniformly. Students moved away fastest from the pathway most associated with entry-level software work, while the more applied and human-facing subfields held their ground better." Slashdot reader BrianFagioli writes: Nova Learning says the share of surveyed middle and high school students naming Computer Science and AI as their primary academic interest fell from 42.3 percent in 2025 to 27.9 percent in 2026, while Engineering rose from 11.9 percent to 23 percent. The biggest gains came from Mechanical and Aerospace Engineering... [B]roader enrollment data points in the same direction. The National Student Clearinghouse Research Center reported declines in Computer and Information Science enrollment at four year institutions, even as Engineering grew. AI coding tools are not proven to be the cause, but as software development changes and AI handles more coding tasks, students may be starting to rethink what a future in technology should look like. [Undergraduate enrollment in CS programs at four-year institutions fell 8.1%, to approximately 606,000 students.]

Read more of this story at Slashdot.

"Turns out, Silicon Valley isn't especially altruistic," writes the nonprofit education news site The 74. They're reading a new book promising "the inside story of how Big Tech catalyzed, co-opted, and ultimately came to capture computer science and AI education in America". Written by New York Times business reporter Natasha Singer, Coding Kids: Big Tech's Battle to Remake Public Schools tells "the story of the nonprofit Code.org and its charismatic, Harvard-educated leader, Hadi Partovi," according to their review: Thirteen years ago, Partovi... delivered a worrying message: Kids who didn't learn to write code would be left behind. And the long-term success of the United States economy depended on training these students to fill a million open tech jobs.... Fast-forward to 2026, and now we're dealing with AI, and tech is reading from a similar playbook. Asked by The74's Greg Toppo, "Does this moment seem different to you?", Singer replies, "This moment is different, but also similar. "We are in a moment in society where a lot of people have increased distrust of these huge tech companies, and we see a wave of parents pushing back against tech in schools. But we also see waves of people pushing back against Flock cameras, against data centers, that there's this feeling that tech has taken so much, and that people feel like they have lost control — that tech is being enacted on them... And parents are worried about the effects of unfettered tech access and kids' compulsive use of social media and phones, and so there's a different climate. And yet there seems to be a disconnect in some ways with AI because you see that Microsoft and OpenAI and Anthropic and Google are all competing to get their AI tools into schools, and you see school districts across the country say "We've partnered with OpenAI." "We are a ChatGPT Pioneer School," or "We've partnered with Microsoft, and we're going to use 10,000 licenses of CoPilot." It's amazing to me. We have had these cycles of tech in schools where there are all these promises about the latest tech, laptops, learning apps, massive open online courses, virtual reality, big data's going to revolutionize schools and like democratize access to education for kids and get them these great career skills, and we keep having these cycles. My concern is that we don't learn anything. One of the reasons I wrote this book is because it feels like we have collective amnesia. Now we're in the sixth or eighth cycle of this — and shouldn't we be asking questions about the push for AI in schools, based on what we've learned about the push for all the other things that came before? Two Slashdot posts are cited in the book, both submitted by long-time Slashdot reader theodp (Slashdot UID #442,580), who even gets a shout-out in the book's "Acknowledgements" section (along with consumer advocate Ralph Nader). Ironically, one member of Amazon's "Vine" program received a free copy of the book in exchange for a review — and apparently misunderstood its topic, writing that it made coding "feel approachable and even fun... [T]his is exactly the kind of book that could help a child become interested in technology without feeling overwhelmed by it. I particularly liked the way it encourages kids to be curious, experiment, and solve problems on their own. I would definitely recommend Coding Kids to parents, grandparents, or teachers looking for a good introduction to coding..."

Read more of this story at Slashdot.

Teen reading, math, and science scores have fallen to their lowest levels since international PISA testing began in 2000, with 15-year-olds now reading at roughly the level previously expected of students a year younger. The Organization for Economic Co-operation and Development (OECD) linked weaker results to more screen time, less reading for pleasure, and digital distraction. It also found that students who regularly used AI chatbots for tasks like drafting essays and summarizing text scored about 20 points lower in science, roughly equivalent to a year of learning. Reuters reports: A 2012 reading high of 501 on PISA's index had declined to a score of 466 last year. The test is widely regarded as the world's leading gauge of educational performance and its results are closely scrutinized by governments and educators. "In reading, more screen time and less reading for pleasure have gone hand in hand with weaker results," OECD head Mathias Cormann told a press conference. "We're also seeing more hasty reading, students rushing through a text and giving a quick wrong answer." Reading scores fell more sharply in students from better-off backgrounds, the study added. Hindered by falling reading standards, average teenage science and maths skills were also at their lowest this century. Science fell from a 2009 high of 506 on the index to 486, while maths was down from 502 to 469 in the same period. East Asia was the best-performing region. Chinese cities that participated in the test, Japan, Korea, Singapore and Taiwan had the best educational systems with Britain and Estonia the only countries outside the region that made it into the top 10 in reading, mathematics and science.

Read more of this story at Slashdot.

Federal authorities on Tuesday unsealed an indictment against 17 Iranians affiliated with the tech firm Mabna Institute, alleging a campaign of vast cybertheft on behalf of the Iranian government against universities, governments and companies.

It’s a second wave of indictments against the Tehran-based firm, expanding on and replacing a 2018 indictment of nine of the defendants from then and adding others. 

“Today’s charges, which include eight additional defendants, reveal the broader network allegedly behind a sweeping, state-sponsored campaign to steal research and intellectual property from American universities, businesses, and government institutions,” said Jamie McDonald, U.S. Attorney for the Southern District of New York. “More than eight years after making the original indictment public, these charges make clear that the passage of time will not deter us from identifying and pursuing those who target the United States from abroad.”

Unlike in 2018, the United States is currently waging a war against Iran that recently saw a 60-day negotiation deadline pass with no progress.

“Cyber operations have become a central instrument of national power, and attacks on American and allied institutions carry direct consequences for our security and economic strength,” McDonald continued.

According to the Justice Department, Gholamreza Rafatnejad and Ehsan Mohammadi founded the Mabna Institute around 2013 with the goal of helping Iranian universities and scientific and research organizations to steal from foreign scientific efforts. In doing so, it paid hackers-for-hire listed in the indictment.

The institute has compromised more than 100,000 professors’ email accounts globally, the indictment alleges, and successfully compromised 8,000 accounts at 144 U.S. universities and 178 universities in other parts of the world.

Its hackers used stolen credentials to take academic journals, dissertations and e-books across all fields of research, at least 31.5 terabytes worth in total. The institute sometimes sold stolen data, according to the indictment. 

“Through the course of the conspiracy, U.S.-based universities spent more than approximately $3.4 billion to procure and access such data and intellectual property,” a press release on the indictment states.

The defendants also have compromised and stolen from email accounts for at least five U.S. federal and state government agencies, 42 U.S. companies and 11 foreign companies, among them HBO. 

In all, the indictment brings 14 separate, sometimes overlapping charges against the 17 defendants, with sentences for each offense ranging from two to 20 years.

In conjunction with the indictment, the State Department’s Rewards for Justice program is offering up to $10 million for information leading to the location of four of the defendants.

The post Eight years later, federal authorities re-up charges against alleged Iranian hackers at Mabna Institute appeared first on CyberScoop.