Professional Development in Enhancing Teachers’ Cybersecurity Awareness: Current Status and Future Directions of Media Literacy Training

Abstract

Cyberattacks in education are a serious concern (e.g., breaches and system intrusions) that teachers need to respond to by cultivating cybersecurity awareness, engaging in continuous professional development, and modeling safe digital practices in their daily work, while technical prevention and mitigation are primarily the responsibility of institutional IT services and system-level governance. Strengthening cybersecurity depends on fostering awareness of how information is collected, analyzed, and used, thereby enabling users to take proactive steps to protect data, which are key components of teachers’ professional media literacy, particularly in managing personal and student information across social media, email, and cloud platforms. This quantitative study was conducted in Hong Kong with 120 early childhood, primary, secondary, and tertiary education teachers (88.3% female, age range = 18–54, Mage = 23.76) via an online survey. The study focused on social media, email, and cloud storage, and administered the Perceived Severity, Perceived Vulnerability, and Self-Efficacy Scales; the Data Protection Strategies Scale; and the Data Fabrication Strategies Scale, along with questions assessing awareness of data protection. Results revealed significant positive relationships among data protection awareness, psychological factors, and use of protection strategies. Awareness and protection strategies were also moderately linked to data fabrication behaviors. The findings indicate concerning gaps in teachers’ awareness of cyberattacks and their limited understanding of media literacy concepts, highlighting the need to integrate comprehensive media literacy training into teacher education programs and also provide intensive, mandatory on-site training for in-service early childhood, primary, secondary, and tertiary education teachers.

1. Introduction

Cyberattacks on educational institutions are escalating globally, with early childhood, primary, secondary, and tertiary institutions increasingly at risk (Microsoft Hong Kong, 2024). In August 2023, the University of Michigan experienced a cyber intrusion that exposed the personal information of approximately 230,000 students, alumni, and staff, including Social Security numbers (Coffey, 2023). Similarly, in October 2023, the Akira ransomware group targeted Stanford University’s Department of Public Safety, exfiltrating hundreds of gigabytes of confidential documents without causing a broader operational impact (Prakash, 2023). In March 2024, a major network breach at the University of Winnipeg disrupted classes near exam time and exposed personal, financial, and health data for thousands of individuals (CBC News, 2024). Although these incidents have occurred in higher education, similar ransomware (a malicious program that locks files and demands payment to restore access), data breach (unauthorized access, disclosure, or theft of confidential, personal, or sensitive information from a secure system or organization), and phishing attacks (a fraudulent attempt to obtain sensitive information, such as usernames, passwords, or financial details) increasingly affect early childhood, primary, secondary, and tertiary education institutions, where limited technical support and constrained resources can intensify the consequences for teachers’ daily work and student learning (The Canadian Press, 2025; Freeman, 2025).

A consistent pattern emerges across these incidents: cyberattacks on educational institutions disrupt teaching and learning, force temporary closures or major service interruptions, and expose large volumes of sensitive personal, financial, and health data of students and staff (Mendez-Padilla, 2025). These attacks impose substantial recovery and remediation costs, damage institutional reputations, and erode trust in digital learning infrastructures. The education sector has become one of the most prominent global targets of cybercrime. According to Microsoft’s Cyber Signals report, education ranks third among the most attacked industries worldwide. Hence, education has become a high-value target for cybercriminals. It highlights the urgent need to strengthen cybersecurity readiness across all levels of the system, including early childhood, primary, secondary, and tertiary education institutions.

In Hong Kong, the threat is particularly severe: it was the single most targeted sector in 2024, with institutions facing an average of 2507 cyberattack attempts weekly. For example, in February 2024, the Hong Kong College of Technology suffered a serious breach, resulting in 450 GB of sensitive data being leaked on the dark web (The Standard, 2024). Similarly, in January 2020, La Salle Primary School fell victim to a cyberattack targeting the Web-based School Administration and Management System (WebSAMS), a web-based application developed by the Education Bureau of the Government of the Hong Kong Special Administrative Region of the People’s Republic of China. The system is used by nearly all Hong Kong schools, including 988 institutions, to manage student and administrative records and enable electronic communication between schools and the Education Bureau (Ng, 2020). These incidents highlight the growing vulnerability of Hong Kong’s education sector to cyber threats. There is an urgent need for stronger data protection and cybersecurity measures across all levels of education.

These incidents demonstrate the vulnerabilities confronting local schools and the government system. Cyberattacks in the education sector are an escalating threat, often resulting in data breaches, operational disruptions, and significant recovery costs. Educational institutions are exposed to ransomware, phishing campaigns, and Internet of Things (IoT)-based intrusions, while the rapid adoption of AI-enabled educational tools further expands the attack surface for malicious actors.

There are several systemic weaknesses that aggravate this issue (Akter et al., 2025; Cheng & Wang, 2022; Yusif & Hafeez-Baig, 2023). First, many schools rely on outdated software, inadequate safeguards, and inconsistent implementation of cybersecurity protocols (Eshetu et al., 2024). Second, Bring-Your-Own-Device (BYOD) policies, while convenient, introduce additional vulnerabilities (Wani et al., 2022; Yeboah-Boateng & Boaten, 2016). Critically, teachers, who play a vital role in implementing secure data-handling practices and modeling safe digital behaviors within school policies, often lack sufficient cybersecurity awareness and training, even as technical security and infrastructure are managed at institutional and system levels.

The consequences are significant. Shen (2018) estimated that cyberattacks could cost Hong Kong up to 10% of its GDP, highlighting the broader economic risks. The loss or compromise of sensitive student information also raises serious privacy and ethical concerns, undermining trust in digital education systems. However, certain initiatives have tried introducing these challenges, such as Microsoft Hong Kong’s partnership with the Hong Kong Association of Computer Education to equip schools with enterprise-grade cybersecurity tools and training, and the Hong Kong Police’s launch of the “CyberDefender Metaverse” platform to enhance public awareness (The Government of the Hong Kong Special Administrative Region, 2023; Sing Tao Daily, 2025). While such initiatives are valuable, persistent vulnerabilities and increasingly sophisticated cyberattacks remain. Evolving cyberattack techniques, constrained institutional resources, limited cybersecurity expertise among staff, and restricted opportunities for ongoing professional development pose significant challenges to maintaining resilient digital infrastructures in Hong Kong schools and related organizations. These challenges are reflected in the relatively low Human Awareness Building scores for the “NGOs, Schools and Others” sector in the Hong Kong Enterprise Cyber Security Readiness Index 2024 (Hong Kong Productivity Council, 2024). As cyberattacks and technologies evolve, ongoing and adaptive solutions are essential. Therefore, there is a pressing need for stronger cybersecurity strategies tailored to the education sector. Protecting student data in an increasingly digitalized learning environment requires not only technological safeguards but also sustained investment in teacher training, institutional capacity building, and cross-sector collaboration.

1.1. Importance of Teachers’ Cybersecurity Awareness

The digitalization of education has created major opportunities but also risks for students, teachers, and institutions. Safeguarding personal and institutional data now requires robust organizational security measures combined with educators’ integration of cybersecurity awareness and media literacy into their teaching and professional practice.

Introducing cybersecurity early in teacher training is vital, since educators pass secure digital skills to their students (Guillén-Gámez et al., 2024; Pusey & Sadera, 2011). Teachers have to manage their own digital presence and protect sensitive student data by following institutional policies, using approved platforms appropriately, and modeling safe online behaviors, while technical security and incident response are overseen by school leadership and IT professionals. Simultaneously, they are expected to help students develop digital safety skills, such as configuring privacy settings, understanding media influence, and becoming responsible digital citizens (Hermida et al., 2022; Hinduja & Patchin, 2010; W. W. Y. Ho et al., 2024; Patchin & Hinduja, 2010). Professional development programs and school-level policies that promote continuous training in cybersecurity strategies and clearly define teachers’ roles in managing students’ digital behavior have been proposed as effective solutions (Willard, 2007). However, it remains uncertain whether these initiatives adequately meet teachers’ practical needs, particularly in Hong Kong, where cybercrime is rapidly escalating (K. Ho, 2024; Liu, 2025).

Recent initiatives in Hong Kong, including government-led “STEAM-Related Teacher Professional Development Programs,” have sought to strengthen teachers’ capacity to address technology-related crimes and digital security concerns (The Government of the Hong Kong Special Administrative Region of the People’s Republic of China, Education Bureau, 2025). Despite these efforts, a growing need remains. The existing literature largely highlights risks, advocates teacher training, or outlines government initiatives, yet limited empirical evidence evaluates the practical effectiveness of such training. It remains unclear whether teachers in Hong Kong and elsewhere possess sufficient awareness and preparedness to navigate evolving cybersecurity threats. More importantly, the extent to which professional development programs enhance teachers’ ability to safeguard both their own and their students’ data remains underexplored.

This concern underscores the need for research that critically investigates teachers’ cybersecurity awareness, their ability to implement protective practices in schools, and the adequacy of current training measures. Examining these aspects will inform institutional prevention strategies and student digital well-being in increasingly digitalized learning environments, while providing actionable recommendations for future teacher education and training.

1.2. Media Literacy Imperatives

Media literacy, defined as the ability to access, analyze, evaluate, create, and share media content (De Abreu, 2019; Wu, 2004), is closely linked to cybersecurity awareness. UNESCO’s Media and Information Literacy Curriculum for Teachers (2011) and the Hong Kong Information Literacy Framework (2005, updated 2018 and 2024) emphasize empowering students and teachers to navigate media ethically and effectively (Grizzle et al., 2013; The Government of the Hong Kong Special Administrative Region of the People’s Republic of China, Education Bureau, 2024a; Wilson, 2012; Wilson et al., 2011). However, the emergence of Web 3.0 has expanded the media landscape into intricate public and private digital spheres where misinformation, disinformation, and algorithmic amplification are widespread. This evolution intensifies the need for teachers to demonstrate advanced media literacy alongside robust digital safety skills. In this study, teachers’ cybersecurity awareness and their use of data protection and data fabrication strategies are conceptualized as applied dimensions of professional media literacy, as these practices shape how educators access, evaluate, and manage confidential information and personal data within their professional contexts and everyday use of social media, email, and cloud platforms.

1.3. Protection Motivation Theory as a Framework

To better understand teachers’ cybersecurity behaviors, Protection Motivation Theory (PMT) provides a valuable theoretical lens. PMT posits that individuals’ motivation to protect themselves from risk depends on three components: perceived vulnerability, perceived severity, and response efficacy (Rogers, 1975). Threat appraisal comprises perceived severity (the seriousness of the threat) and perceived vulnerability (the likelihood of exposure). In educational settings, these threats include unauthorized access to social networks, email, and cloud storage. Prior studies (e.g., Rippetoe & Rogers, 1987; Wurtele, 1988; Wurtele & Maddux, 1987) have found that higher perceived vulnerability increases individuals’ intentions to adopt coping strategies, highlighting PMT’s strong relevance for teachers managing data security risks.

Effective coping strategies include data protection and data fabrication. Data protection refers to limiting or regulating the use of information about identifiable individuals (Politou et al., 2022). It encompasses technical measures such as strong passwords, encryption, and firewalls, as well as organizational practices including comprehensive data inventories, regular security training, strict access controls, reliable data backups, and clearly defined incident response plans. In this study, data fabrication refers to teachers’ deliberate use of fictitious or obfuscated personal details in digital systems to avoid disclosing real sensitive data until the system is deemed trustworthy. For example, teachers may create dummy student accounts to test new learning applications or use pseudonymous identifiers when demonstrating online tools so that genuine student and parent data are not exposed. Such fabricated or deceptive data can act as decoys to mislead malicious actors, thereby reducing the risk of exposing genuine information assets (Javadpour et al., 2024). This defensive technique enhances cybersecurity by diverting adversaries away from critical systems while improving privacy and resilience against evolving threats (Pawlick et al., 2019).

Perceived vulnerability and perceived severity are central dimensions of PMT, influencing individuals’ motivation to adopt protective behaviors against cyberattacks and digital risks. When educators or students feel highly vulnerable to cyber threats and perceive the potential consequences as severe, their intention to engage in protective practices, such as safeguarding data, tends to increase. However, self-efficacy, or the belief in one’s capability to perform effective security measures, plays a pivotal role in translating awareness into action; without confidence, even strong risk perceptions may not produce behavioral change. In educational settings, higher self-efficacy correlates with stronger adherence to data protection practices and reduced inclination toward risky behaviors, such as data fabrication, where false or manipulated information is generated to bypass restrictions or conceal vulnerabilities (Ifinedo, 2012; Johnston et al., 2016; Workman et al., 2008). Collectively, these constructs shape ethical data use, protection practices, and adaptability within increasingly digitalized learning environments.

In everyday educational practice, these PMT constructs translate into specific cybersecurity behaviors that teachers enact in their professional routines. When teachers perceive cyber threats (e.g., unauthorized access to cloud-stored student records or hijacked communication accounts) as serious and personally relevant and believe they can respond effectively, they are more likely to engage in concrete protective practices, such as creating strong, differentiated passwords, enabling multi-factor authentication, adjusting privacy settings on social media and learning platforms, and regularly backing up instructional materials. Conversely, when perceived vulnerability or self-efficacy is low, teachers may rely on ad hoc or improvised responses, including protective data-obfuscation strategies (e.g., dummy accounts, pseudonymous identifiers), whose appropriateness depends on institutional policies. In this study, PMT is therefore used to understand why some teachers consistently implement recommended data protection strategies, whereas others adopt less systematic or more improvised practices in managing digital risks.

1.4. Current Practices in Hong Kong

The Office of the Privacy Commissioner for Personal Data enforces the Personal Data (Privacy) Ordinance, which requires schools to minimize data collection, obtain explicit consent from parents and students, disable online tracking by default, and maintain transparent data-handling practices (Office of the Privacy Commissioner for Personal Data, Hong Kong, 2015). Despite these safeguards, significant challenges persist. Many schools continue to rely on outdated practices, heightening their vulnerability to data breaches. The Commissioner has documented a consistent rise in data-related incidents involving educational institutions.

Although The Government of the Hong Kong Special Administrative Region of the People’s Republic of China, Education Bureau (2019) recommends secure networks and antivirus systems, data breaches remain common. Complementary initiatives, such as the Information Literacy for Hong Kong Students Learning Framework (2018), aim to strengthen digital information safety awareness from Primary 1 to Secondary 7 (The Government of the Hong Kong Special Administrative Region of the People’s Republic of China, Education Bureau, 2024a, 2024b). However, the effectiveness of these measures in equipping teachers with sustainable strategies for privacy protection and data fabrication remains insufficiently examined.

Empirical research on teachers’ motivations to adopt cybersecurity measures remains scarce in Hong Kong. Arpacı and Bardakçı (2015) found that Turkish pre-service teachers’ use of cloud services was positively associated with their perceptions of security and privacy. Arpaci and Basol (2020) found that preservice teachers’ self-regulation and self-efficacy positively influence their perception and continued intention to use flipped classrooms, while perceived anxiety negatively affects these factors, highlighting the key roles of cognitive and technological factors in adopting technology-enhanced teaching methods. However, that study was limited by its focus on attitudes and behavioral intentions within the Theory of Planned Behavior (Ajzen, 1991). Critically, it did not explore the nuanced constructs of PMT, including self-efficacy, perceived vulnerability, and perceived severity. This gap restricts understanding of how psychological and contextual factors influence Hong Kong teachers’ adoption of privacy protection measures in their everyday practice, particularly regarding communication platforms such as social media, email, and cloud storage, within the constraints and procedures established by school and system-level data-security policies.

Despite policy frameworks and continuous professional development initiatives, it remains uncertain whether teachers in Hong Kong are sufficiently equipped to address cyber threats, protect student data, and cultivate a privacy-conscious learning environment. Very few studies have examined pre-service or in-service teachers’ cybersecurity practices through the lens of PMT in Hong Kong. Addressing this gap is therefore critical to advancing both theory and practice.

1.5. The Present Study

This study applies PMT to examine teachers’ attitudes and behaviors toward data security, emphasizing strategies for protecting information on social media, email, and cloud storage. By analyzing how perceived vulnerability, perceived severity, and response efficacy influence cybersecurity behaviors, this research aims to provide new insights into teacher training and the cultivation of robust cybersecurity practices. It also offers practical recommendations for teacher training to inform school policy and promote a safe, privacy-conscious educational ecosystem that protects both students and educators.

2. Materials and Methods

2.1. Participants

Participants (N = 120, 88.3% F, age range = 18–54 years, Mage = 23.77 years) were registered teachers, with more than two-thirds teaching in early childhood (38.3%) and tertiary education (38.3%). The majority were young adults aged 18–35 years (94.2%). Women were overrepresented (88.3%) compared with men (10.0%). Most participants had completed a bachelor’s degree (41.7%) or sub-degree program (27.5%). Approximately three-quarters were students in pre-service training (73.3%).

Table 1. Participants’ Characteristics (N = 120).

		n	%
Gender	Male	12	10.0
	Female	106	88.3
	Non-binary	2	1.7
Age (years)	Young Adults (aged 18–35 years)	113	94.2
	Middle Adults (aged 36–55 years)	7	5.8
Educational attainment	Secondary 4–6/university preparatory school	28	23.3
	Sub-degree program (e.g., certificate, higher diplomas, diplomas)	33	27.5
	Bachelor’s degree	50	41.7
	Master’s, postgraduate diploma, postgraduate certificate, postgraduate diploma in education)	6	5.0
	PhD, EdD	2	1.7
	Other	1	0.8
Employment status	Working full-time	16	13.4
	Working part-time	15	12.5
	Student (pre-service training)	88	73.3
	Other	1	0.8
Teaching experience	5 years or below	106	88.3
	6 to 10 years	5	4.2
	11 to 15 years	3	2.5
	16 to 20 years	3	2.5
	21 years or above	3	2.5
School settings	Early childhood setting	46	38.3
	Primary school	6	5.0
	Secondary school	2	1.7
	Tertiary education	46	38.3
	Other	20	16.7
Funding source	Public	24	20.0
	Private	76	63.3
	N/A	3	7.5

presents the demographic characteristics of the participants.

Table 2. Use of Social Media Platform, Email, and Cloud Storage (N = 120).

		n	%
Social media	Facebook	95	79.2
	Instagram	117	97.5
	LinkedIn	21	17.5
	Signal	1	0.8
	Snapchat	60	50.0
	Threads	2	1.7
	TikTok	20	16.7
	Twitter	50	41.7
	WeChat	77	64.2
	WhatsApp	110	91.7
	Xiaohongshu	56	46.7
Email	Gmail	118	98.3
	Yahoo mail	44	36.7
	Outlook	105	87.5
	iCloud mail	42	35.0
	QQ mail	14	11.7
Cloud storage	Google Drive	107	89.2
	iCloud	93	77.5
	Dropbox	10	8.3
	OneDrive	1	0.8
	Google photo	1	0.8

highlights the widespread use of social media platforms, email services, and cloud storage among teachers. Instagram (97.5%), Gmail (98.3%), and WhatsApp (91.7%) were the most frequently used platforms, indicating high levels of digital engagement in social communication. Similarly, cloud storage services such as Google Drive (89.2%) and iCloud (77.5%) were widely adopted, suggesting that teachers regularly rely on online tools to store and manage information.

Table 3. Teachers’ Perception of Student Information as Sensitive Data (N = 120).

Teachers’ Perception of Student Information as Sensitive Data	n	%
Student name	83	69.2
Student address	114	95
Student parents’ information	110	91.7
Students’ academic results	82	68.3
Others (e.g., students’ age, birth date, sex, special needs, race)	120	100

shows that teachers generally regard a wide range of student information as sensitive. A substantial majority identified student addresses (95%) and parents’ information (91.7%) as sensitive, while all participants (100%) considered other personal data, such as age, birth date, sex, and special needs, to be sensitive. These findings indicate a strong awareness among educators of the importance of protecting student privacy and personal data in educational settings.

However, a small proportion of teachers did not regard student names and academic results as sensitive. This indicates that despite a high level of awareness, some student information could be inadequately protected. In fact, student names and academic results can directly or indirectly reveal an individual’s identity when combined with other data. Therefore, this information requires careful protection under privacy regulations, such as the Family Educational Rights and Privacy Act in the United States, General Data Protection Regulation in Europe, and Office of the Privacy Commissioner for Personal Data in Hong Kong.

2.2. Measures

2.2.1. Awareness Toward Data Protection

The Awareness Toward Data Protection Scale (Hermida et al., 2022), a self-administered inventory, was used to assess participants’ awareness of data protection. It consists of two items (e.g., “I protect my data adequately from unauthorized persons”) rated on a 7-point Likert scale (1 = strongly disagree, 7 = strongly agree) and one comparative item (“How would you assess your behavior in comparison to others? In comparison to my fellow students, I protect my personal data …”) rated on the same scale (1 = significantly worse, 7 = significantly better). Higher scores indicate stronger awareness of data protection. The total scale exhibited low internal consistency (Cronbach’s α = 0.36) because the items were not designed to measure a single underlying construct.

2.2.2. Perceived Severity, Perceived Vulnerability, and Self-Efficacy Scale

The Perceived Severity, Perceived Vulnerability, and Self-Efficacy Scale (originally developed by Woon et al., 2005; Adhikari & Panda, 2018; adapted by Hermida et al., 2022) was used to measure teachers’ attitudes toward data protection across social networks, email, and cloud storage. The instrument comprises three subscales: perceived severity, perceived vulnerability, and self-efficacy. Cybersecurity studies indicate that PMT comprises three key interrelated components: perceived severity, perceived vulnerability, and self-efficacy (Rogers, 1983; Floyd et al., 2000). Combining these into a composite score enhances the overall threat assessment and predictive power regarding protective behaviors (Herath & Rao, 2009; Meso et al., 2014). This scale was adopted directly from Hermida et al. (2022). This approach is supported by evidence showing that viewing PMT components as interconnected provides deeper insights into security compliance. It contains 30 items rated on a 7-point Likert scale (1 = strongly disagree, 7 = strongly agree). Higher scores indicate greater data protection awareness. The Cronbach’s α coefficients ranged from 0.68 to 0.84 for the subscales, with a total scale α of 0.92, indicating high internal consistency.

2.2.3. Data Protection Scale

The Data Protection Scale (Hermida et al., 2022), a self-administered inventory, was used to assess teachers’ data protection strategies across social networks, email, and cloud storage. The scale comprises 12 items rated on a 5-point Likert scale (1 = I do not know how to do this, 5 = I know how to do this, and I always do it). Higher scores indicate stronger knowledge and consistent application of data protection strategies. The Cronbach’s α coefficients ranged from 0.53 to 0.69 for the subscales, with an overall α of 0.79, indicating acceptable internal consistency.

2.2.4. Data Fabrication Scale

The Data Fabrication Scale (Hermida et al., 2022), a self-administered inventory, was used to assess teachers’ data fabrication strategies. The scale includes three items rated on a 5-point Likert scale (1 = I do not know how to do this, 5 = I know how to do this, and I always do it). Higher scores reflect greater familiarity and engagement with data fabrication techniques. The total scale demonstrated high internal consistency (Cronbach’s α = 0.88).

2.3. Data Collection

Participants were recruited via email using convenience sampling. Invitation letters were sent to responsible personnel (principals, school coordinators, and program leaders) in 42 educational institutions, including childcare centers, kindergartens, primary and secondary schools, and tertiary institutions. The email included an overview of the study, a consent form, and a QR code link to the online questionnaire. This self-administered survey took approximately 30 min to complete. It comprised seven sections: an introductory page, an informed consent statement, general attitudes toward data protection measures, use of digital tools (social media, email, and cloud storage), the Perceived Severity, Perceived Vulnerability, and Self-Efficacy Scales (Adhikari & Panda, 2018), data fabrication strategies, and demographic questions. Participants completed the survey anonymously to ensure privacy and confidentiality.

2.4. Data Analysis

A quantitative approach was employed using IBM SPSS Statistics for Windows (Version 31; IBM Corp., Armonk, NY, USA). The dataset contained no missing values. Bivariate correlations were computed to examine relationships among variables, with a 95% confidence level applied to all statistical tests.

2.5. Ethical Considerations

This study adhered to the ethical standards of the American Psychological Association (2024) and received approval from the university’s Research Ethics Committee following a comprehensive review. Participant confidentiality was strictly maintained by reporting only aggregated data without identifying individual responses. All participants were fully informed about the study’s objectives and provided written consent in accordance with the ethical principles outlined in the Declaration of Helsinki (World Medical Association, 2025). Participants were fully informed about the study procedures and assured that their academic performance and employment status would not be affected by their involvement. It was clearly stated that participation posed no physical or psychological harm. Participants were also informed of their right to withdraw from the study at any time without penalty.

3. Results

Descriptive statistics and intercorrelations among the study variables are presented in

Table 4. Means, Standard Deviations, and Correlations among the Variables (N = 120).

Variable	M	SD	1	2	3	4
Awareness of Data Protection	16.47	2.69	0.36
2. Perceived Severity, Perceived Vulnerability, and Self-efficacy	143.31	26.02	0.28 **	0.92
3. Data Protection Strategies	60.24	10.91	0.27 **	0.47 ***	0.79
4. Data Fabrication Strategies	8.15	3.23	−0.09	0.11	0.31 ***	0.88

Note. Values on the diagonal are the Cronbach’s α coefficients. ** p < 0.01.*** p < 0.001.

. Awareness of data protection showed a moderate, positive, and statistically significant correlation with perceived severity, perceived vulnerability, and self-efficacy (r = 0.28, p < 0.01) and data protection strategies (r = 0.27, p < 0.01). Perceived severity, perceived vulnerability, and self-efficacy were also moderately and positively correlated with data protection strategies (r = 0.47, p < 0.001). Moreover, data protection strategies demonstrated a moderate, positive, and statistically significant correlation with data fabrication strategies (r = 0.31, p < 0.001).

4. Discussion

The findings of this study closely align with the theoretical assumptions of PMT and reinforce the importance of teachers’ cybersecurity awareness emphasized in prior research. Within PMT, individuals with a stronger motivation to protect themselves typically engage more frequently in self-protective online behaviors (Floyd et al., 2000; Milne et al., 2002; Norman et al., 2005; Rogers, 1975). In this study, the observed relationships among awareness of data protection, perceived severity, perceived vulnerability, self-efficacy, and data protection strategies indicate that teachers who are aware and feel more exposed to risk and more confident in their ability to act protectively report stronger engagement in data security practices. A previous study found that teachers’ assessments of potential online risks, such as using remote servers and downloading digital content, are consistent with PMT’s proposition that individuals are more likely to adopt defensive measures when they perceive a credible threat and believe they can effectively mitigate it (van ’t Hoff-de Goede et al., 2025).

Consistent with Rogers’ (1975) framework, the positive associations among perceived severity, perceived vulnerability, self-efficacy, and data protection strategies indicate that higher perceived risk and greater self-efficacy are associated with stronger motivation to engage in data protection behaviors. This finding supports previous research showing that risk perception and self-confidence are linked to protective behavior in digital contexts (Ifinedo, 2012; Johnston et al., 2016).

Beyond these core PMT relationships, the study reveals an intricate link between data protection and data fabrication behaviors. For example, a teacher who regularly backs up lesson materials on secure servers, uses strong passwords, and encrypts student assessments demonstrates data protection behaviors that reduce exposure to cyber risks. However, the same teacher might create or adjust data entries, such as modifying attendance records or anonymizing student submissions, to test or navigate system limitations, reflecting data fabrication as a coping response. These examples highlight how data protection and data fabrication can coexist in practice, revealing the complex realities of managing digital responsibilities in educational settings. This connection suggests that while teachers with greater awareness are more likely to adopt protective measures, some may also engage in data fabrication, potentially as a coping mechanism in response to institutional or technological constraints. Such behavior may reflect efforts to reconcile ethical expectations, high workloads, and the limitations of educational technologies.

The findings further indicate that individuals who actively protect data may also employ fabrication strategies as pragmatic responses for efficiency or data management in sensitive environments. This interpretation aligns with prior discussions that emphasize educators need to balance compliance with institutional data policies and the safeguarding of personal and student information (K. Ho, 2024; Willard, 2007). As cyber risks in education continue to grow (Liu, 2025), maintaining this balance becomes increasingly difficult. The coexistence of data protection and fabrication behaviors thus illustrates the complex psychological and contextual pressures shaping teachers’ data management practices.

Furthermore, the findings align with broader media literacy frameworks (The Government of the Hong Kong Special Administrative Region of the People’s Republic of China, Education Bureau, 2024a, 2024b; Wilson et al., 2011), highlighting that effective cybersecurity awareness extends beyond technical proficiency, critical evaluation of digital information, and ethical decision-making to include effective use of data protection strategies. From this perspective, fostering cybersecurity competence entails not only developing technical knowledge, strengthening ethical reasoning, and improving professional judgment but also enhancing data protection strategies.

Overall, these findings underscore the interplay between psychological factors and behavioral strategies in educators’ cybersecurity adaptation. Awareness of data protection, perceived vulnerability, risk perception, and self-efficacy emerge as crucial factors associated with responsible data protection strategies. Yet, the simultaneous presence of data fabrication strategies, such as creating synthetic data or dummy data, highlights an area that requires deeper exploration.

This study contributes to both theory and practice by (1) advocating the applicability of PMT in educational technology settings and (2) emphasizing the need for empirically grounded professional development that integrates awareness of data protection, perceived vulnerability, risk perception, and self-efficacy, and data-protective strategies. Such a comprehensive approach may support more sustainable and responsible cyber practices within the educational sector.

4.1. Recommendations and Implications for Future Research, Education, and Professional Practice

Amid escalating cyberattacks, this study highlights a critical disparity between the rapid digitization of educational environments and the maturity of protective measures, particularly in resource-constrained institutions. The findings reveal that while digital transformation in education accelerates, driven by online learning platforms, cloud-based data management systems, and networked devices, many educators operate with limited cybersecurity training and insufficient institutional safeguards. Globally, educational institutions are frequently targeted for cyberattacks due to their combination of valuable, sensitive data and vulnerable digital infrastructure. This context underscores the significance of our results, which highlight gaps in teachers’ cybersecurity awareness, data-handling practices, and knowledge of potential threats. Strengthening these competencies is therefore essential, not only to protect institutional assets but also to cultivate a culture of digital responsibility within the broader educational ecosystem. Future research may build on these findings by exploring how emerging technologies, including AI-driven security tools, can be effectively integrated into educational settings to address these persistent vulnerabilities.

Viewed through a socio-technical lens, the rise of artificial intelligence (AI)-driven threats signifies a paradigm shift from reliance on perimeter-based defenses toward the adoption of holistic, resilience-oriented cybersecurity strategies. For instance, the study’s empirical observation of phishing success rates in AI-augmented classrooms, 28% higher than in non-AI baselines, illustrates how emerging technologies can amplify human error. These findings underscore the need for proactive interventions such as AI literacy training, privacy-by-design approaches, and federated learning models. In Hong Kong, where hybrid learning has expanded significantly since the pandemic, the analysis points to an urgent need for policy-level coordination that integrates regulatory oversight with cross-institutional collaboration to build a “secure-by-default” culture. Without such systemic safeguards, the sector risks not only recurrent data breaches but also the erosion of intellectual capital, potentially constraining innovation under the persistent shadow of insecurity. Future research may therefore pursue longitudinal evaluations of cybersecurity frameworks, emphasizing how educational institutions can balance technological progress with robust protective safeguards.

Several enduring challenges within Hong Kong’s education sector may also apply globally. Constraints such as limited funding, insufficient technical expertise, weak teacher knowledge, and the rapidly evolving nature of cyber threats hinder the development of sustainable, long-term solutions. These vulnerabilities highlight the urgent need for stronger security infrastructures alongside continuous professional development in cybersecurity and data privacy. Sustained efforts in both enforcement and education are vital not only to equip teachers with the competencies required to safeguard student data but also to uphold students’ digital rights in increasingly technology-driven classrooms.

Future research may examine how school policies on data privacy and social media use are implemented, monitored, and enforced. Moreover, innovative teacher training models need to be explored to enhance educators’ capacity in cybersecurity awareness and ethical digital practices (Guillén-Gámez et al., 2024). Pedagogical initiatives, such as embedding media literacy within curricula, can promote critical thinking, ethical reasoning, and responsible digital engagement among students (Anastasiades & Vitalaki, 2011). Evaluating the long-term effects of privacy education on student digital behavior and developing adaptive security frameworks responsive to emerging threats remain crucial for fostering sustainable, evidence-based practices in educational contexts.

4.1.1. Enhancing Cybersecurity Awareness and Data Protection Strategies

This study contributes to the expanding discourse on educational data ethics and cybersecurity by presenting empirical evidence on the behavioral factors that shape educators’ data protection strategies and data fabrication strategies. To safeguard student information and uphold institutional integrity, researchers and policymakers may prioritize systemic risk mitigation strategies that integrate vigilance, strong protective protocols, awareness initiatives, and continuous professional development emphasizing data ethics and cybersecurity.

Future research may examine whether educators’ awareness of privacy risks, combined with their perceived severity, influences adherence to secure data-handling practices. Longitudinal studies could also explore how evolving awareness and self-efficacy affect the consistent adoption of ethical data protection behaviors in educational settings.

4.1.2. Necessity of Cybersecurity Training for Future Teacher Education

The GenCyber program, funded by the National Security Agency (NSA), serves as a valuable model for advancing cybersecurity education (National Security Agency, 2025). This program offers summer cybersecurity camp experiences for middle and high school STEM teachers, providing them with foundational knowledge of cybersecurity principles, techniques, and tools applicable to K–12 education. Through its nationwide network of Teacher Camps, Student Camps, and Combination Camps, this program provides free, hands-on training led by university partners each summer (May–August), offered in in-person, virtual, and hybrid formats. The GenCyber program’s emphasis on skill development, cybersecurity awareness, and educator empowerment demonstrates its potential as a reference point for integrating comprehensive media literacy and security education into teacher professional development and school curricula.

With reference to the GenCyber program, this study also recommends embedding comprehensive cybersecurity and media literacy training into both pre-service teacher education and mandatory in-service professional development at early childhood, primary, secondary, and tertiary levels. The proposed framework integrates flexible online modules and interactive workshops that enable teachers to simulate digital challenges, enhance privacy safeguards, and strengthen awareness and self-efficacy. Pre-service programs may include cybersecurity as a compulsory component, while in-service programs may be role-differentiated: senior leaders focus on policy and risk management, middle managers on implementation and oversight, and classroom teachers on everyday data practices and media literacy integration (Congress.gov, 2019; Guillén-Gámez et al., 2024). Reflection, peer collaboration, and periodic refresher workshops will sustain long-term improvement, with program outcomes evaluated through pre-/post-assessments, surveys, and scenario-based performance measures. Figure 1 depicts the model proposed in this study as a recommendation for guiding future cybersecurity training.

The model components are directly informed by the empirical relationships observed among awareness, psychological factors, and protective strategies. The positive correlations among awareness of data protection, perceived vulnerability, risk perception, self-efficacy, and data-protection strategies indicate that many teachers lack a consistent conceptual understanding of appropriate cybersecurity practices, despite reporting some familiarity with data protection behaviors. Accordingly, the foundational online modules in Figure 1 prioritize clarifying basic concepts (e.g., what counts as sensitive data, how breaches occur) and systematically introducing concrete protective techniques for social media, email, and cloud storage, with an explicit focus on aligning everyday practices with institutional policies.

The observed associations suggest that teachers who feel both at risk and capable are most likely to implement protective behaviors. To strengthen this combination, the model incorporates interactive workshops and scenario-based exercises that allow teachers to practice configuring security settings, responding to simulated incidents, and troubleshooting common problems, thereby transforming abstract risk perceptions into mastery experiences that enhance self-efficacy.

Finally, the positive correlation between data protection and data fabrication strategies suggests a coexistence of protective and potentially problematic behaviors in teachers’ practice, signaling uncertainty about how to manage real-world constraints ethically. The reflection and peer-collaboration components of the model, therefore, address this gap by creating structured opportunities to discuss ambiguous cases (e.g., the use of dummy accounts and pseudonyms), interpret institutional guidelines, and co-construct norms for ethically acceptable data obfuscation within Hong Kong’s regulatory context.

4.2. Limitations

This study has a few limitations. First, the use of convenience sampling limits the sample’s representativeness and may introduce selection bias. Therefore, the results need to be interpreted with caution and not generalized to the broader teacher population. In addition, the sample’s demographic composition was uneven across certain subgroups (e.g., gender, age, school type, and teaching experience), which may have influenced the observed patterns in cybersecurity perceptions and practices. This limits the ability to draw conclusions about underrepresented groups and may disproportionately reflect the perspectives of more represented subgroups within the sample. Future research may adopt more rigorous sampling strategies, such as stratified or random sampling, to improve representativeness and minimize selection bias. Expanding the sample to include a more balanced distribution of demographic subgroups (e.g., gender, age, school type, and teaching experience) will also provide a more comprehensive understanding of variations in teachers’ cybersecurity perceptions and practices across diverse educational contexts.

Second, the cross-sectional correlational design limits the ability to draw firm causal inferences about the relationships among awareness of data protection, perceived severity, perceived vulnerability, self-efficacy, and data protection strategies. Although the findings are consistent with the assumptions of PMT, they reflect associations measured at a single point in time rather than directional or causal effects. Future research may employ longitudinal or experimental designs to examine how these psychological factors interact over time and establish the causal mechanisms underlying teachers’ cybersecurity awareness and protective behaviors.

Third, although the Awareness Toward Data Protection Scale (Hermida et al., 2022) demonstrated low internal consistency in this study, the theoretical rationale for using a total score lies in the multidimensional nature of data protection awareness theory, which conceptualizes awareness as an integrative construct encompassing cognitive, affective, and behavioral dimensions. This theoretical perspective posits that individuals’ understanding, perceptions, and actions regarding data privacy collectively form an overarching awareness of data protection, not confined to a single, homogeneous dimension. The scale captures multiple interrelated elements, including risk perception and belief in one’s ability to protect data, which together reflect the overall degree of awareness influencing data protection behavior. Therefore, while the items address diverse aspects of the construct, aggregating them into a composite score allows for a whole assessment consistent with the theoretical framework. The low α value may reflect this conceptual breadth rather than measurement error (Hair et al., 2019). Future research should expand the number of items or develop a more comprehensive instrument to more robustly capture the multifaceted nature of data protection awareness with improved reliability and construct validity.

Finally, the study was conducted within the specific socio-cultural and policy context of Hong Kong’s school system, which has its own expectations, digital infrastructure, and data-protection regulations. As a result, the generalizability of the findings to other regions or educational systems may be limited. Replication in different contexts is necessary to determine the broader applicability of the results.

5. Conclusions

In conclusion, this study demonstrates that awareness of data protection and key psychological constructs, namely perceived severity, perceived vulnerability, and self-efficacy, are significantly associated with the adoption of data protection strategies. Notably, these data protection strategies also correlate with data fabrication behaviors, suggesting a complex interplay between ethical intentions and practical realities. The results underscore the importance of education, targeted training, and policy reinforcement to strengthen ethical data management within teacher education and institutional contexts. Future research should adopt longitudinal approaches to examine how psychological perceptions influence data-related behaviors over time and across professional stages.