Education Cyber Statistics: Schools and Universities

Schools, colleges and universities report cyber breaches far more often than the average business, yet most published "education cyber statistics" are recycled from secondary roundups with no traceable source. This page brings together the official figures: the UK government's Cyber Security Breaches Survey education institutions findings for 2025/2026 and 2025 (Department for Science, Innovation and Technology, DSIT), the US Government Accountability Office (GAO) report on K-12 cyber security, and the US Cybersecurity and Infrastructure Security Agency (CISA) K-12 programme. Each figure carries its publisher, edition and period in the same sentence or table row, and incidents are described in aggregate only. It is for school business managers, IT leads, governors, trustees and university security teams who need defensible numbers for risk registers and funding cases. The cross-sector picture is in the Cybersecurity Statistics Guide, and practical defence in the Cybersecurity for Schools Guide and Cybersecurity for Higher Education Guide. Last reviewed: November 2026.

Key takeaways

Almost every university identifies attacks. 98% of UK higher education institutions and 88% of further education colleges identified a breach or attack in the 12 months before the Cyber Security Breaches Survey 2025/2026, against 43% of businesses.
Risk rises with school size. 49% of primary schools and 73% of secondary schools identified a breach or attack in the same survey, both up on the 2025 edition (44% and 60%).
Phishing dominates, but impersonation and denial of service stand out. Among colleges and universities that identified a breach, 96% saw phishing, 79% impersonation and 49% denial of service (CSBS 2025/2026).
Governance is strong on paper. 92% of higher education institutions and 73% of primary schools have a formal incident response plan, against 25% of businesses (CSBS 2025/2026).
Disruption is measured in weeks and months. GAO reported that US K-12 officials described lost learning of 3 days to 3 weeks after a cyber attack, and recovery times of 2 to 9 months (GAO-23-105480, October 2022).

How to read education cyber statistics

Publisher and source	What it measures	Period and sample	Caveats
DSIT: Cyber Security Breaches Survey 2025/2026, education institutions findings	Self-reported breaches, attacks and controls in UK schools, colleges and universities	Fieldwork August to December 2025; 273 primary, 222 secondary, 33 further education (FE), 49 higher education (HE)	Unweighted samples; margins of error up to plus or minus 16.2 points for FE and 11.9 for HE
DSIT: Cyber Security Breaches Survey 2025, education institutions findings	Same measures, previous edition	Fieldwork August to December 2024; 250 primary, 240 secondary, 52 FE, 32 HE	Small HE base, so FE and HE are often combined
GAO: GAO-23-105480, K-12 cyber security	Impact reported by US state and local officials	Published 20 October 2022	Qualitative ranges; GAO notes the national scale of K-12 attacks is unknown
CISA: K-12 Cybersecurity programme and "Protecting Our Future" report	Federal assessment and recommendations for US K-12	Report released January 2023	Mostly guidance rather than counts

Identified, not actual: the CSBS counts only breaches institutions themselves identified. DSIT notes the true figures are likely higher, and larger institutions with more monitoring are likely to identify more.
Two different bases: prevalence figures use all institutions; breach-type figures use only those that identified a breach. Do not multiply them without saying so.
Small samples move: with only 33 FE colleges in 2025/2026, year-on-year changes for FE are indicative only.

How often education institutions are attacked

Institution type	Identified breach or attack, CSBS 2025 (fieldwork 2024)	Identified breach or attack, CSBS 2025/2026 (fieldwork 2025)	Attacked at least weekly, CSBS 2025/2026
Primary schools	44%	49%	14%
Secondary schools	60%	73%	20%
Further education colleges	85%	88%	24%
Higher education institutions	91%	98%	29%
All UK businesses (comparison)	43%	43%	Not compared in the annex

Daily attacks: 11% of secondary schools reported being attacked at least daily in CSBS 2025/2026.
United States: CISA's K-12 Cybersecurity page states that K-12 cyber incidents average more than one per school day, without giving a dataset or period. GAO's 2022 report adds that the precise national scale of K-12 cyber attacks is unknown, which is why US figures are thinner than UK ones.

Types of attack

The CSBS 2025/2026 breaks down breach types among institutions that identified a breach or attack. FE and HE are combined because of small bases.

Breach type	Primary	Secondary	FE and HE combined	Businesses
Phishing	90%	96%	96%	88%
Impersonation of the organisation in emails or online	31%	44%	79%	28%
Viruses, spyware or malware (excluding ransomware)	11%	15%	51%	16%
Denial of service	3%	7%	49%	6%
Takeover of website, social media or email accounts	2%	6%	18%	5%
Ransomware	0%	6%	14%	3%

Ransomware in the previous edition: in CSBS 2025 (fieldwork 2024), 7% of primary schools, 3% of secondary schools and 15% of FE and HE institutions that identified a breach reported ransomware, against 6% of businesses. Low single-digit shares in small samples swing from year to year, so quote the edition.
Denial of service in tertiary education: nearly half of colleges and universities that identified a breach reported denial of service in 2025/2026, about eight times the business rate. See DDoS Attack Statistics for the wider picture.
Account takeover: 18% of FE and HE institutions that identified a breach reported takeover of websites, social media or email accounts. Large, transient user populations of students and staff make identity the main attack surface. See the Education Identity Security Guide.

Impact and recovery

Negative outcomes: among institutions that identified a breach in CSBS 2025/2026, 13% of primary schools, 20% of secondary schools and 49% of FE and HE institutions reported a negative outcome on their systems, against 19% of businesses.
Lost learning: GAO's report GAO-23-105480 (October 2022) records US state and local officials describing lost instruction ranging from 3 days to 3 weeks after a cyber attack.
Recovery time: the same GAO report records recovery ranging from 2 to 9 months.
Costs: GAO notes monetary losses from downtime and recovery resources but gives no national cost figure. We found no official national cost series for education and have left cost estimates out.
Federal response in the US: CISA's January 2023 report "Protecting Our Future" answers this evidence with three recommendations for K-12 organisations: put the highest-priority controls in place first (multifactor authentication, fixing known exploited vulnerabilities, implemented and tested backups, an exercised incident response plan and a strong training programme), align near-term investment with CISA's Cross-Sector Cybersecurity Performance Goals, and build a longer-term plan on the NIST Cybersecurity Framework.
Why sizes differ: the gap between primary schools (49%) and universities (98%) in CSBS 2025/2026 is likely to reflect larger user populations, research data, more internet-facing services and better detection in bigger institutions, so a small school reporting no breaches should not assume it was not targeted.

Governance, plans and insurance

Measure (CSBS 2025/2026)	Primary	Secondary	FE	HE	Businesses
Cyber security a very or fairly high priority for governors or senior management	98%	97%	97%	96%	72%
Governor, trustee, board member or senior manager responsible for cyber security	85%	73%	82%	100%	31%
Business continuity plan covering cyber security	74%	80%	79%	86%	33%
Formal incident response plan	73%	77%	79%	92%	25%
Specific cyber insurance policy	9%	15%	36%	61%	Measured differently
Not insured against cyber breaches	6%	8%	0%	24%	Measured differently

Insurance awareness gap: 33% of primary schools and 30% of secondary schools did not know whether they were insured against cyber breaches (CSBS 2025/2026). Many institutions hold cyber cover as part of a broader policy (52% of primary and 46% of secondary schools in the same survey), so check what that cover actually includes.
Cyber Essentials awareness: 20% of primary schools, 57% of secondary schools, 85% of FE colleges and 98% of HE institutions were aware of the Cyber Essentials scheme (CSBS 2025/2026).

Technical controls

Control (CSBS 2025/2026)	Primary	Secondary	FE	HE	Businesses
Any two-factor authentication for networks or applications	89%	86%	94%	98%	47%
Patch management policy (updates applied within 14 days)	45%	62%	73%	84%	34%

"Any two-factor authentication" means at least some 2FA somewhere, not universal coverage. Phishing and account takeover figures suggest coverage gaps remain, typically for students, legacy systems and shared or service accounts. The MFA Adoption Statistics page covers how to read 2FA figures.

What the numbers mean for defenders

Plan for phishing and impersonation first: with phishing in 90% or more of identified breaches across every institution type, email authentication (SPF, DKIM, DMARC), reporting routes and payment verification for supplier and parent communications give the best return.
Close identity gaps: extend phishing-resistant MFA from staff to administrators, students where feasible, and third-party access. Remove or monitor shared and service accounts in management information systems and learning platforms.
Prepare for disruption measured in weeks: GAO's 3 days to 3 weeks of lost learning argues for offline exam, safeguarding and payroll fallbacks, and tested, offline or immutable backups.
Treat denial of service as a tertiary risk: universities and colleges should confirm upstream protection for learning platforms and student portals, especially around enrolment and exam periods.
Make plans real: high plan coverage means little without exercises. Rehearse with governors, and test the insurance or risk-protection notification route.
Patch faster: fewer than half of primary schools have a 14-day patch policy, so managed service contracts should state patch timelines.

Finding	Control area	Framework reference
Phishing in most identified breaches	Awareness and email protection	NIST CSF 2.0 PR.AT-01; NIST SP 800-53 AT-2
Account takeover and impersonation	Multi-factor authentication	NIST SP 800-53 IA-2; CIS Controls v8.1 Control 6
Weeks of lost learning	Incident response and recovery plans	NIST CSF 2.0 RC.RP-01; NIST SP 800-53 IR-8
Slow patching	Vulnerability and patch management	NIST SP 800-53 SI-2; CIS Controls v8.1 Control 7

Common mistakes when using education statistics

Quoting HE figures for schools: 98% of universities and 49% of primary schools are very different populations.
Treating breach-type shares as prevalence: "6% of secondary schools had ransomware" is wrong; it is 6% of those that identified a breach.
Ignoring margins of error: FE and HE figures can move by more than 10 points through sampling alone.
Repeating untraceable counts: many widely shared "schools attacked per year" figures have no primary source. If you cannot trace it to the publisher, leave it out.

Practitioner checklist

Quote each figure with publisher, edition and institution type, and state whether it is prevalence or a share of breached institutions.
Check the latest Cyber Security Breaches Survey education annex each spring before updating a risk register.
Extend MFA to all staff and administrator accounts, then to students and third parties where feasible.
Configure SPF, DKIM and DMARC and a simple phishing reporting route for staff.
Keep tested offline or immutable backups for management information, finance and learning platforms.
Write fallbacks for exams, safeguarding records and payroll that work during weeks of outage.
Confirm in writing what your insurance or risk-protection arrangement covers and how to notify.
Set and monitor a 14-day patch target, including in managed service contracts.

Education Sector Cyber Statistics: Attack Rates for Schools, Colleges and Universities