When I was a school district tech director for 11 school years, a ransomware attack is what most often kept me up worrying at night. As a result we moved a lot of things out of our own managed data center and to various cloud and hosted services. The hosted services had more security expertise than our small staff had, and not all our eggs were in one basket.
https://www.postbulletin.com/news/local/in-wake-of-nearby-cyberattacks-rochester-area-schools-say-it-could-happen-to-anybody