Campus cyber risks deepen worldwide

Cyber-attacks on higher and further education institutions jumped 63 per cent over a year, exposing universities and colleges to a sharper wave of ransomware, data theft, hacktivism and state-linked intrusion as digital learning systems become central to academic life.

The findings point to 425 recorded incidents across 67 countries in the latest 12-month assessment period, compared with 260 in the preceding year. The rise reflects not only more aggressive criminal activity, but also the growing value of academic data, research systems and student records. Institutions now hold large stores of personal information, intellectual property and commercially valuable research, while often operating complex networks used by students, staff, external contractors and visiting researchers.

Data breaches showed one of the steepest climbs, rising 73 per cent, while hacktivist activity increased 75 per cent. Ransomware attacks were also up 21 per cent, underlining the persistence of groups that target public-facing institutions where service disruption can quickly create pressure to restore systems. Education networks are attractive because academic calendars create predictable periods of vulnerability, including enrolment, examinations and admissions cycles.

The threat profile is widening. Criminal gangs continue to pursue ransom payments and stolen credentials, while state-linked actors are focused on research, defence-related collaborations, biotechnology, artificial intelligence and advanced engineering. Hacktivist groups have also turned universities into symbolic targets during periods of geopolitical tension, aiming to deface websites, leak data or interrupt online services.

Universities face a difficult balance between openness and control. Research institutions are designed to encourage collaboration across borders, with shared platforms, remote access tools and large numbers of temporary users. That culture supports academic exchange but complicates the enforcement of strict security rules. Legacy systems, uneven funding and fragmented governance add further strain, particularly where cyber teams are expected to protect sprawling networks with limited budgets.

The UK picture shows the scale of exposure. A government-backed survey found that 91 per cent of higher education institutions and 85 per cent of further education colleges had identified a cyber breach or attack over the past year. Secondary schools and primary schools were also affected, though at lower levels. Among higher and further education bodies that suffered attacks, a significant share reported incidents occurring weekly.

Phishing remains the most common entry point, but attackers are using more sophisticated methods to exploit cloud services, third-party suppliers and stolen logins. Infostealer malware has become a particular concern because compromised credentials can be sold or reused months after the initial infection. Once inside a network, attackers can move laterally, identify valuable data and deploy ransomware at moments when disruption will be most damaging.

The education sector’s reliance on external software providers has created another pressure point. Learning management systems, payroll platforms, research databases, library services and student administration tools all expand the attack surface. A single supplier breach can expose multiple institutions, making vendor oversight a central part of cyber resilience.

Artificial intelligence is adding speed and scale to the threat. Attackers are using automation to scan for exposed systems, tailor phishing messages and generate convincing impersonation attempts. Education staff and students are vulnerable to such tactics because they often handle frequent email communication from unfamiliar contacts, including applicants, parents, vendors and research partners.

The financial impact can be severe. A major breach can force teaching disruption, delay examinations, interrupt payroll, expose sensitive personal data and damage institutional reputation. Recovery costs can include forensic investigation, legal advice, notification requirements, system restoration, identity protection services and long-term security upgrades. For smaller colleges, even a short outage can strain finances and operations.

Policy responses are tightening. Public sector institutions in several jurisdictions face stronger reporting expectations, greater scrutiny of ransomware payments and pressure to meet baseline cyber standards. Security agencies have urged education bodies to strengthen multi-factor authentication, patch management, backup testing, staff training and incident response planning.