Published November 6, 2025
BY GRACE GRAHL
On Sept. 17, students on CUSD’s high school and middle school campuses received an email advertising a job opportunity under the title of “Executive Personal Assistant,” paying $300 a week, with no details of what this job entailed or any business logo. What caused students to rapidly fill in their personal information was the apparent sender of this email: a Carmel Middle School employee.
With the escalation of deepfakes, AI misinformation and hacking, Carmel Unified School District is implementing tools to protect students and teachers while using their school-issued computers.
Recently, the CUSD department of technology has curated a new button to report phishing attacks on the inbox homepage, as well as a YubiKey, a multi-factor authentication, for staff only that can authenticate the user to prevent hackers from accessing staff members’ accounts. While the YubiKey is only for staff members, Manuel Carrera, CUSD senior director of information technology, has introduced the “phishing hook” onto the inbox homepage for all students in the district.
Phishing attacks become a decreasing threat to CUSD cybersecurity as the district rolls out new technology. Courtesy of IKON IMAGES
“We regularly assess our infrastructure, strengthen our practices and look for ways to make security more seamless and effective for everyone,” Carrera explains. “The cybersecurity landscape is ever-evolving, and IT staff work diligently to ensure that our cybersecurity posture is prepared to meet the challenge of keeping our staff and students safe.”
The phishing hook replaces an older button that was more reactive than proactive. Now, if a student or staff member is unsure of whether an email they have received is malicious, they can press the phishing hook button in the email and after the email is shut down and checked, they will receive a notification on if the email was a phishing attempt, giving students and staff an easy opportunity to protect themselves and their sensitive information without having to do much work.
While there has been mostly positive responses from staff members, with most teachers finding the phishing hook easily on the inbox homepage, some question this “useful” technology.
“It is totally unnecessary,” art teacher Steven Russell comments. “It is only there for people who are technologically illiterate.”
To make the decision process easier of what is and isn’t malicious, the tech department is also introducing software that inserts into Google workspace, authenticating each email before it reaches its recipient to preemptively prevent most malicious emails from ever reaching its target. Before this, emails would only go through Google workspace, which didn’t catch most of the malicious emails that reached the recipients.
Starting in November, staff members are also beginning to use the Yubikey, which will serve as a multi-factor authentication during the sign-in process. According to the tech department, it will create a second layer of protection for teachers’ emails from getting hacked and sending malicious emails unintentionally or unconsciously.
While the technology being introduced is not in direct response to the September incident concerning students personal information being potentially leaked, there was an indication to begin implementing these tools, as phishing scams are constantly evolving and sophistication of threats get larger.
There was guidance on what to do to protect students’ personal information after the incident, but CHS principal Libby Duethman urges students and staff to be skeptical of emails and question them before clicking.
“The thing is that if something sounds too good to be true, that should be anybody’s warning,” Duethman says. “And really think logically would this person be the person that would be sending out a job opportunity? Probably not.”
CUSD is not new to these types of data breaches or incidents. In early 2019, the district sent a Notice of Data Breach to the California Department of Justice along with employees of CUSD, notifying them that their social security numbers, marriage and birth certificates and sensitive medical information were potentially leaked to an outside source through a phishing scam. It was never confirmed whether the information was accessed, but the importance of the situation was taken seriously, and preventative measures were taken to keep this from happening in the future.
The tech department has worked with the Monterey County Office of Education in securing CUSD’s data and sensitive information since this incident.
“Cybersecurity is about trust, learning, and responsibility. At Carmel Unified, we take that trust seriously,” Carrera affirms. “Our goal is to protect the tools and information that make teaching and learning possible, while supporting staff and students in using technology safely and confidently.”
Not only do staff members receive helpful tools, but they also receive a multitude of online trainings that cover topics such as sexual harassment, bloodborne pathogens and cybersecurity to gain the required knowledge for the upcoming year. Most teachers took around 15-25 minutes on the cybersecurity unit, with many understanding that the unit was only as thorough as a passive online training could be.
“Every single time I do these trainings, I wonder if the students get this training as well,” CHS Spanish teacher Tricia Bean wonders. “I feel like a lot of this information students should be getting as well. From sexual harassment to cybersecurity, students should be able to receive this information too.”
While CUSD only directs their online training to the staff members at the beginning of the school year as a part of their yearly training, any students who wish to learn more about cybersecurity and their safety are able to talk to anyone in the technology department.
With updates and advancements arriving, students and staff alike are hopeful for the future of Carmel Unified School District’s cybersecurity while staying vigilant and skeptical.
