Cyberattacks on educational institutions surge by 37% as new academic year begins

As schools and educational institutions prepare for the new academic year, they face an increase in cyberattacks compared to last year.

Data shows educational institutions are the most targeted sector, with attacks up 37% compared to 2023, ahead of government, healthcare, finance, and banking.

The academic community is particularly exposed to cyber threats due to factors such as limited budgets, constrained cybersecurity resources, and outdated infrastructure. The expansion of online learning has further broadened the attack surface, adding additional infrastructure, software platforms, and access points that can be exploited.

"Educational institutions need to prioritise cybersecurity, implementing measures that foster a culture of digital awareness among students and staff," said Andrius Buinovskis, head of product at NordLayer. "The stakes are especially high at the start of the new academic year, and educational organisations need to be prepared for cyberattacks."

The Threat Landscape

A survey by the UK government found that 86% of further education colleges reported a breach or attack in the past year. Additionally, 41% of cybersecurity incidents in higher education were linked to social engineering tactics.

Ransomware attacks are particularly prevalent in education, with 80% of lower education providers and 79% of higher education institutions targeted. These attacks involve malware that encrypts files, rendering them inaccessible until a ransom is paid. The financial impact of these attacks can be significant.

Cybercriminals target personal information, financial records, and research data, which can be sold on the black market for up to $265. The theft of intellectual property and identity data can have long-term consequences for educational institutions and their communities.

Addressing the Vulnerabilities

To address these threats, educational institutions must adopt a proactive approach to cybersecurity. Buinovskis emphasised that regular updates, staff training, and strategic investments are essential for reducing risks. He also noted the importance of conducting periodic assessments of current infrastructure to stay ahead of potential threats.

"Technology alone won’t solve all security problems. The human element plays an even bigger role," Buinovskis stated. "Every member of the academic community—from students to teachers—must play an active role in cybersecurity. Simple practices like using strong, unique passwords and learning to identify phishing attempts can significantly improve an institution's security posture."