Top 10 Education Cyber Threats and How to Respond

Schools, colleges and universities are attacked more often than almost any other type of organisation, yet most run on small IT teams, shared devices and thousands of accounts that change every academic year. This page ranks the ten cyber threats education institutions face most often, from phishing and impersonation to student insiders, supplier breaches and research theft. For each one you get what it looks like in an education setting, how to detect it and the controls that work. The ranking draws on the UK Cyber Security Breaches Survey education findings, the Information Commissioner's Office (ICO) analysis of insider breaches in schools, the US Government Accountability Office (GAO) review of K-12 cyber security, CISA's K-12 recommendations and the UK Department for Education (DfE) cyber security standards. It is written for school and trust IT leads, district technology directors, university security teams and the governors and leaders who fund them. For sector context and regulation read the Cybersecurity for Schools Guide and the Cybersecurity for Higher Education Guide; this page is the prioritised threat list.

The Top 10 at a glance

Phishing and credential theft
Impersonation and payment diversion fraud
Ransomware and data extortion
Student insiders and misused staff logins
Weak account controls: no MFA, shared and stale accounts
Unpatched internet-facing systems and end-of-support technology
Edtech and student information system supplier compromise
Malware on unmanaged and personal devices
Denial of service and disruption of online learning
Theft of research data and intellectual property

#	Threat	Most exposed	First control
1	Phishing	All institutions	MFA on staff accounts, easy reporting button
2	Impersonation and payment fraud	Finance offices, trusts, universities	Call-back verification for bank detail changes
3	Ransomware and extortion	Districts, colleges, universities	Immutable, tested offline backups
4	Student insiders	Secondary schools, colleges	Staff MFA, no written passwords, role-based access
5	Weak account controls	All institutions	Termly account review, separate admin accounts
6	Unpatched edge systems	Institutions with VPNs, remote access, legacy servers	Patch critical and high fixes within 14 days
7	Supplier compromise	Schools using cloud SIS and edtech	Supplier inventory, contract security terms
8	Malware on devices	Colleges and universities with open networks	Managed anti-malware, segmented guest networks
9	Denial of service	Online learning, exams, admissions	Upstream DDoS protection, offline exam plans
10	Research theft	Research-intensive universities	Trusted Research due diligence, segregated research data

1. Phishing and credential theft

Phishing is the dominant threat in every part of education. In the UK Cyber Security Breaches Survey 2025/26 education institutions findings (fieldwork August to December 2025), phishing was involved in 90% of primary schools, 96% of secondary schools and 96% of further and higher education institutions that identified a breach or attack. The same survey found 49% of primary schools, 73% of secondary schools, 88% of further education colleges and 98% of higher education institutions identified a breach or attack in the previous 12 months.

What it looks like: fake login pages for the institution's Microsoft or Google tenant, messages imitating the head teacher, the student loans body or a parcel courier, and compromised staff mailboxes used to phish parents and other schools.

Detect it: track user-reported phishing per month, sign-ins from new countries or anonymising networks, new inbox forwarding rules and mass outbound mail from a single account.

Controls: MFA on every staff account with cloud or remote access (a DfE standard), a one-click reporting button, short and frequent awareness training for staff and students, and phishing-resistant MFA for administrators and finance. See the Phishing Guide.

2. Impersonation and payment diversion fraud

Impersonation, where attackers pose as the institution or someone in it, is the second most common attack type. The 2025/26 survey found it among 31% of primary schools, 44% of secondary schools and 79% of further and higher education institutions that identified a breach or attack. In practice this means fake supplier invoices, requests to change a contractor's bank details, gift card requests that appear to come from the head teacher and fraudulent payroll changes.

Detect it: alert on changes to supplier bank details and on payroll changes made from a new device, and watch for lookalike domains registered close to the institution's own.

Controls: a written rule that bank detail changes are verified by calling a number already on file, dual approval for new payees, DMARC at enforcement on the institution's domains, and short targeted training for finance and office staff. See the Invoice Redirection and Supplier Bank Detail Fraud Guide.

3. Ransomware and data extortion

Ransomware is less frequent than phishing but causes most of the lasting damage. The GAO report on K-12 cyber security (GAO-23-105480) found that officials reported losing between three days and three weeks of instruction after an attack, with recovery taking two to nine months. The UK survey found ransomware among 14% of further and higher education institutions and 6% of secondary schools that identified a breach or attack. Extortion groups increasingly steal student and staff records before encrypting, then threaten to publish them, which turns an outage into a safeguarding problem. See the Rhysida Ransomware Profile Guide for one group whose joint government advisory lists education among its targets of opportunity.

Detect it: alerts on backup deletion or changes to backup retention, mass file renames, new domain administrator accounts and large outbound transfers to cloud storage.

Controls: the DfE standard asks for at least three copies of important data on at least two separate devices, one offsite, with immutable backups tested termly. CISA lists implementing and testing backups and exercising an incident response plan among its highest-priority K-12 controls. See the Ransomware Prevention Guide and the Backup Security and Immutable Backup Guide.

4. Student insiders and misused staff logins

Education has an insider threat other sectors do not: curious, capable students. The ICO analysed 215 personal data breach reports from insider attacks in education between January 2022 and August 2024 and found that 57% were caused by students. Stolen login details were involved in 30% of incidents, and students were responsible for 97% of those; almost a third of insider incidents involved guessed passwords or passwords found written down. In one case a college student used a staff login to reach a system holding data on more than 9,000 people. The UK survey found unauthorised access to files or networks by students at 10% of secondary schools and 23% of further and higher education institutions that identified a breach or attack.

Detect it: staff accounts signing in from student devices or student network ranges, staff accounts active during lessons when the teacher is teaching, and access to management information systems outside normal patterns.

Controls: MFA on staff accounts, screen locking on classroom PCs, no passwords on sticky notes, and access to student records limited by role. Treat a student breach as a safeguarding and learning matter as well as a security one. See the Education Identity Security Guide.

5. Weak account controls: no MFA, shared and stale accounts

Education identity estates churn every year: new cohorts, leavers, supply teachers, visiting lecturers, alumni and governors. Accounts that are never disabled, shared generic logins in classrooms and administrators using their everyday account for privileged work all widen the attack surface. The DfE standard asks schools to create accounts only when needed, disable them when someone leaves, review accounts every term, use dedicated admin accounts, and require MFA for staff with cloud or remote access and for IT administrators.

Detect it: count enabled accounts with no sign-in for 90 days, accounts for people who left at the end of the last academic year, shared accounts, and administrators without MFA.

Controls: drive account creation and removal from the management information system or student record system, run an end-of-year leaver sweep, and give administrators separate accounts with MFA. See the MFA Guide and the Orphaned and Dormant Accounts guide.

6. Unpatched internet-facing systems and end-of-support technology

VPN gateways, remote desktop services, firewalls, web servers and old on-premises systems are a common route in for ransomware groups. CISA lists mitigating known exploited vulnerabilities among its highest-priority controls for K-12. The DfE standard asks schools and colleges to apply fixes within 14 days where the vendor rates them critical or high, the CVSS v3.1 score is 7.0 or above, or no rating is given, and to track end-of-support dates for every system.

Detect it: keep an external attack surface list, compare it weekly with the CISA Known Exploited Vulnerabilities Catalog, and alert on systems past end of support.

Controls: remove direct remote desktop exposure, put MFA on VPN access, patch edge devices first and plan replacements before end of support. See the Patch Management Guide.

7. Edtech and student information system supplier compromise

Schools now hold most student data in cloud platforms run by suppliers: student information systems, learning platforms, assessment tools and safeguarding software. A breach at one supplier exposes many institutions at once. PowerSchool reported that it became aware on 28 December 2024 of unauthorised exfiltration of personal information from its Student Information System environments through PowerSource, one of its customer support portals, affecting current and former students and teachers at schools using the system. The lesson for schools is the customer-side control: knowing which suppliers hold which data, what access their support staff have, and how quickly you will be told.

Detect it: maintain a register of every edtech supplier with the data each holds, and review supplier support access and administrative audit logs where the platform provides them.

Controls: collect only the data each tool needs, put breach notification times and security terms in contracts, ask suppliers for strong security by default at no extra charge (a CISA recommendation), and remove tools no longer in use along with their data. See the Supplier Security Policy Template.

8. Malware on unmanaged and personal devices

Universities and colleges run open networks for thousands of personal laptops and phones, and schools often have shared classroom PCs. The 2025/26 survey found viruses, spyware or malware (excluding ransomware) among 51% of further and higher education institutions that identified a breach or attack, against 16% of businesses. Infected personal devices bring infostealers that harvest saved passwords and session cookies for institutional accounts.

Detect it: endpoint detection alerts on managed devices, DNS and network detections on guest and student networks, and sign-ins with valid session tokens from unexpected devices.

Controls: centrally managed anti-malware on institutional devices (a DfE standard), separate networks for personal and student devices, conditional access that requires a managed device for staff systems holding sensitive data, and a BYOD Policy Template that sets expectations.

9. Denial of service and disruption of online learning

The GAO report lists distributed denial of service and video conferencing disruption alongside ransomware and phishing among the attacks K-12 schools face. Attacks cluster around exams, admissions and enrolment periods, and some are launched by students who want a lesson or a test cancelled.

Detect it: traffic baselines and alerts from the internet provider or DDoS service, and monitoring of availability for the learning platform, admissions site and remote exam tools.

Controls: DDoS protection from the upstream provider or a cloud service, waiting rooms and host controls on video meetings, and an offline fallback plan for exams and critical deadlines. See the DDoS Protection Guide.

10. Theft of research data and intellectual property

Research-intensive universities hold valuable intellectual property, sensitive medical data and dual-use research. The UK National Protective Security Authority (NPSA) Trusted Research guidance warns that research obtained by a state-backed actor, legitimately or not, can harm researchers and their work, and provides checklists for academia and senior leaders on international collaboration. This threat is quieter than ransomware and is usually found late.

Detect it: monitor bulk downloads from research data stores, access from unusual countries to research systems, and new external collaborators added to sensitive projects.

Controls: due diligence on partners using the Trusted Research checklist, segregated environments for sensitive research data with named access, and offboarding of researchers and visiting academics at the end of projects. See the Cybersecurity for Higher Education Guide for research computing.

Measuring whether defences are working

Metric	Target	Threats it tracks
Staff accounts with MFA (and administrators with phishing-resistant MFA)	100%	1, 4, 5
Enabled accounts for people who have left	Zero after each termly review	4, 5
Critical and high fixes applied to internet-facing systems within 14 days	100%	3, 6
Last successful backup restore test	Within the current term	3
Edtech suppliers with a data register entry and contract security terms	100% of suppliers holding personal data	7
User-reported phishing per month	Rising reports, falling clicks	1, 2

Mapping to OWASP

Most education threats are organisational and identity threats rather than application flaws, so the OWASP mapping is narrow. Where institutions build or integrate with student data APIs, the OWASP API Security Top 10 (2023) applies; the rest map to MITRE ATT&CK and NIST CSF 2.0.

Threat	OWASP API Security Top 10 (2023)	MITRE ATT&CK v20	NIST CSF 2.0
1. Phishing	Not applicable	T1566, T1078	PR.AA-03, PR.AT-01
2. Impersonation and payment fraud	Not applicable	T1566, T1657	PR.AT-01
3. Ransomware and extortion	Not applicable	T1486, T1567	PR.DS-11, RS.MA-01
4. Student insiders	API2 Broken Authentication	T1078, T1213	PR.AA-03, PR.AA-05
5. Weak account controls	API2 Broken Authentication	T1078, T1110	PR.AA-01, PR.AA-05
6. Unpatched edge systems	API9 Improper Inventory Management	T1190	ID.RA-01, PR.PS-02
7. Supplier compromise	API10 Unsafe Consumption of APIs	T1199, T1195	GV.SC-07
8. Malware on devices	Not applicable	T1204	DE.CM-01, ID.AM-08
9. Denial of service	API4 Unrestricted Resource Consumption	T1498	DE.CM-01
10. Research theft	Not applicable	T1213, T1567	PR.AA-05

CISA recommends that K-12 organisations start with its highest-priority controls, then align near-term investment with the CISA Cross-Sector Cybersecurity Performance Goals and build a longer-term plan on the NIST Cybersecurity Framework. See the CISA Cross-Sector Cybersecurity Performance Goals (CPGs) Guide.

Where to start

If you can do only three things this term: turn on MFA for every staff and administrator account (threats 1, 4 and 5); make sure at least one backup copy is immutable or offline and run a restore test (threat 3); and put a call-back rule in place for any bank detail change (threat 2). Then sweep for leaver accounts, patch internet-facing systems against the KEV catalogue and build the supplier register.

Single schools and small districts should lean on free and shared services: CISA and NCSC resources, MS-ISAC and K12 SIX in the US, the DfE standards and the risk protection arrangement in England, and the security features already included in their productivity suite. Trusts, large districts and universities need a security operations capability that can watch identity and endpoint signals out of hours, supplier assurance at scale and, for universities, a research security function. The Education Sector Cyber Statistics page gives the wider numbers for board papers.

Practitioner checklist

MFA is on for every staff account with cloud or remote access, and every administrator uses a separate account with MFA.
Accounts are created and removed from the student and staff record systems, with a termly review and an end-of-year leaver sweep.
Bank detail and payroll changes are verified by calling a known number, with dual approval for new payees.
Three copies of important data exist on two separate devices with one offsite and immutable, and a restore is tested every term.
Critical and high fixes for internet-facing systems are applied within 14 days and checked against the KEV catalogue.
Every edtech supplier holding personal data is on a register with contract security and breach notification terms.
Personal and student devices sit on separate networks from staff systems, and institutional devices run managed anti-malware.
A cyber response plan is exercised at least yearly, including an offline fallback for exams and a route to report to the ICO or the relevant authority.
Research-intensive institutions apply Trusted Research due diligence and segregate sensitive research data.

Top 10 Education Cyber Threats: What Hits Schools and Universities and How to Respond