Higher education attacks increased by more than 8% compared with the second half of 2025, even as ransomware incidents across the broader education sector fell by 13%. Researchers recorded 104 attacks on schools, colleges and universities worldwide between January and June, including 36 incidents confirmed by the targeted organisations.
The Gentlemen claimed 15 education-sector attacks during the period, matching Qilin as the most active ransomware operation targeting educational institutions. Twelve of its claims involved universities or other higher education bodies, highlighting a sharp shift towards organisations holding valuable research, financial and personal information.
The group’s education-related claims jumped 275% from the previous six-month period. Six of the 15 cases were confirmed, giving The Gentlemen the largest number of verified education attacks attributed to any ransomware operation during the first half.
Confirmed victims included universities and business schools in Austria, Brazil, the Czech Republic, Japan, Poland and Thailand. The geographic spread reflects the group’s rapid expansion since it emerged as an independent ransomware-as-a-service organisation in mid-2025.
The Gentlemen is believed to have developed from ArmCorp, formerly an affiliate of the Qilin ransomware network. A payment dispute involving roughly $48,000 preceded the breakaway, after which the operators began promoting their own platform on underground forums.
The organisation offers affiliates as much as 90% of ransom proceeds, above the 70% to 80% commonly offered by competing ransomware services. That arrangement has helped it recruit experienced attackers and scale operations rapidly. The group claimed hundreds of victims across dozens of countries during its first year of activity.
Universities present attractive targets because their networks combine large user populations, decentralised technology systems and extensive stores of sensitive data. Students, researchers, contractors and visiting academics frequently require access to institutional systems, increasing the number of accounts, devices and remote connections that must be secured.
Academic institutions also maintain research databases, health records, financial details, identity documents and intellectual property. Their dependence on third-party learning platforms, cloud services and laboratory systems creates additional routes through which attackers can gain access or disrupt operations.
Nearly 693,000 people were notified that their information had been exposed through confirmed education ransomware attacks during the first half. A May breach involving Japan-based CKC Network and Gakusan accounted for about 664,000 of those records.
The median known ransom demand reached $420,620, an increase of 53% from $275,000 in the second half of 2025. No institution publicly confirmed paying a ransom, while five said they rejected their attackers’ demands.
Mount Royal University in Canada received the largest disclosed demand, worth about $1.9 million in bitcoin. A ransomware incident beginning on June 17 caused prolonged disruption, while attackers claimed to have stolen 10 terabytes of information.
Lehigh Carbon Community College in the United States faced a $100,000 demand after an attack attributed to Medusa. The disruption forced the cancellation of classes for more than a week, demonstrating how ransomware can interfere directly with teaching, examinations and administrative services.
The United States remained the most targeted country, accounting for 34 of the 104 recorded education attacks. However, that represented a 44% decline from the second half of 2025. The UK recorded 13 attacks, up from four, while Brazil registered eight and Thailand five.
The Gentlemen commonly seeks entry by exploiting vulnerable internet-facing systems, including Fortinet security appliances, remote desktop services, virtual private networks and remote-management tools. Once inside, affiliates can use legitimate administrative software to move through networks without immediately attracting attention.
Its ransomware can attack Windows and Linux systems, network-attached storage and virtualised environments. Before encrypting files, the malware may terminate database and backup services, erase recovery copies and weaken endpoint security controls.
The group also employs double-extortion tactics, stealing information before encrypting systems and threatening publication if payment is refused. Naming institutions on leak sites and social media can increase pressure by raising fears over regulatory penalties, litigation and damage to public confidence.
Security specialists have urged universities to prioritise patching internet-facing devices, strengthen multifactor authentication and separate critical systems from general campus networks. Offline backups, tested restoration procedures and stricter control of privileged accounts can reduce the operational leverage available to attackers.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
