Published: 27 October 2026 | By AOLC
A school network is not a typical office network. It carries learner records, exam results, staff payroll data, and the personal information of hundreds of minors — all on a single infrastructure that students actively try to probe and bypass. South African schools are increasingly targeted by ransomware operators who know that education institutions often run outdated equipment with minimal IT oversight and are under pressure to pay quickly to restore access before the next school day.
Getting school network security right does not require an enterprise budget. It requires the right architecture, a handful of well-configured tools, and a clear policy that everyone — teachers, learners, and support staff — understands and follows.
POPIA requires schools to protect the personal information of learners as minor data subjects. A breach of learner records is a notifiable incident under the Act — and the school's principal is typically the responsible party.
Ransomware groups do not target schools because the data is especially valuable. They target schools because the environment is predictable: limited IT staff, old hardware, unpatched software, and a principal who will pay R50,000 in Bitcoin before an exam week rather than lose three years of learner records. South Africa saw multiple school and municipality ransomware incidents between 2023 and 2026, most of which were never publicly disclosed.
Learner records are attractive for a second reason. They contain ID numbers, home addresses, and contact details for minors — information that identity thieves and social engineers can use for years. A database of 1,200 Grade 12 learners is worth more on a dark-web market than a database of 1,200 adults, because the learners have clean credit histories and their parents will not discover the fraud until the learner applies for their first account.
of education-sector ransomware victims globally paid the ransom in 2025, according to Sophos — the highest rate of any vertical, driven by exam deadlines and minimal backup maturity.
The most common mistake in school networks is a flat topology: one SSID, one VLAN, and every device — teacher laptops, learner tablets, the CCTV system, and the admin server — on the same broadcast domain. When a learner's device gets infected with malware, it has direct access to everything else.
The fix is segmentation. A properly segmented school network has at least three zones:
This architecture costs nothing extra if you already have a managed switch and a firewall that supports VLANs — both of which any reputable IT provider will recommend as baseline equipment for a school. See our guide to building a CAT lab that actually works for more on the physical infrastructure that supports this layout.
Tip
Name your SSIDs carefully. "SchoolAdmin" and "SchoolStaff" tell an attacker which network to focus on. "AOLC-A", "AOLC-B", and "AOLC-G" (or any opaque names) give away nothing about what is on each network.
DNS-based content filtering is the standard tool for blocking inappropriate content on a school network. You configure your router or firewall to use a filtering DNS resolver (such as Cisco Umbrella, OpenDNS, or a local appliance), and it blocks requests to known gambling, adult, social media, and malware-hosting domains. It is easy to deploy, hard for learners to bypass without administrative credentials, and effective against accidental exposure and drive-by malware.
What content filtering does not do:
Additional cost to enable DNS-based content filtering on most business-grade routers and firewalls — it is a configuration change, not a hardware purchase, and takes under an hour to set up.
Schools are responsible parties under the Protection of Personal Information Act (POPIA). They collect and store the personal information of learners — who are data subjects — and POPIA requires that this information be processed lawfully, stored securely, and protected against unauthorised access.
The practical implications for school IT:
Learners are minor data subjects. POPIA gives extra weight to processing their information, and the Information Regulator has signalled that education institutions are an enforcement priority. Schools that cannot demonstrate basic technical controls are exposed.
Every school network security guide that ends before discussing backup is incomplete. If a ransomware attack bypasses every other control — and experienced operators do bypass them — the only question that matters is how quickly you can restore from a clean backup.
For a South African school, the minimum backup posture is:
South African schools have an infrastructure challenge that most global cybersecurity frameworks do not account for: load shedding. A power cut that takes down the network also takes down the authentication server, the content filter, and in some cases the CCTV system — all of which create security gaps in the minutes before UPS batteries run flat.
The most common failure pattern is a managed switch or wireless access point that does not have UPS power. The firewall stays up (it is in the server room on a large UPS) but the switches and APs go down, so the network drops. When power returns, devices reconnect before the authentication services fully restart, briefly joining with reduced controls.
The fix is to put the networking hardware — switches, APs, and the router — on the same UPS as the server room equipment. A small, dedicated UPS rated for networking gear (typically 600VA to 1000VA) costs between R1,500 and R3,000 and keeps the network running through Stage 4 shedding without difficulty. See our full guide to what load shedding means for your IT infrastructure.
AOLC helps South African schools build networks that protect students, staff, and learner data — without enterprise budgets. Get in touch for a free assessment.
Contact Us