Summary:
- In 2025, educational institutions across the globe endured 251 ransomware incidents, with 94 attacks substantiated by the institutions themselves, as highlighted in a report published by Comparitech on Thursday. Notably, these breaches resulted in the exposure of approximately 3.96 million records.
- Ransomware incidents targeting the education sector exhibited a deceleration in 2025, showing a slight uptick of 2% in incidents involving schools and universities in comparison to the previous year, according to a distinct report released by Comparitech last month.
- The United States bore the brunt of such attacks, tallying 130 occurrences, 50 of which were confirmed by Comparitech. Despite this, the U.S. experienced a 9% reduction in ransomware incidents within its educational institutions from 2024 to 2025.
Analysis:
Over recent years, educational institutions and ed tech companies in the U.S. have persistently succumbed to cyber threats, particularly ransomware attacks. From July 2023 to December 2024, a staggering 82% of K-12 schools faced cyber incidents, as reported by the nonprofit Center for Internet Security.
Yet, despite the total global ransomware incidents skyrocketing to 7,419—marking a 32% increase from the preceding year—Comparitech noted an encouraging trend within the education sector, which did not mirror this surge.
Year-on-year attack statistics remained relatively stable for educational institutions, potentially attributable to various factors, including the migration of certain cybercriminals towards sectors like manufacturing, as per the January Comparitech report.
Moreover, the average ransom demand for educational institutions plummeted by 33%, descending from $694,000 in 2024 to $464,000 in 2025, according to recent findings.
In a notable incident in September, the Uvalde Consolidated Independent School District in Texas was besieged by a ransomware attack, which was confirmed through adistrict Facebook announcement.
This attack led to the temporary closure of schools after ransomware infiltrated critical systems, impacting communication lines, surveillance, and visitor management systems, crucial to ensuring student safety, as articulated in the district’s statement.
In a subsequent post, Uvalde CISD declared that no ransom was paid to the assailants, with system restoration accomplished via backups. At that moment, the district reported no indications of unauthorized access to sensitive data, while an investigation was actively ongoing.
While not officially confirmed by the districts, Comparitech reported that Fall River Public Schools in Massachusetts and Franklin Pierce Schools in Washington were both targeted in 2025, with ransom demands of $400,000 from each district following claims by the Medusa ransomware group regarding data theft.
Both districts were identified among the top five largest ransom requests within the education sector globally for the past year, Comparitech noted.
Ed tech companies have also come under attack, highlighted by significant data breaches affecting millions of sensitive student records at Illuminate Education in December 2021 and PowerSchool in late 2024.
Experts within the K-12 technological landscape anticipate greater accountability imposed upon ed tech entities by governmental authorities at both state and federal levels this year, given the impending enforcement of stricter federal regulations concerning the Children’s Online Privacy Protection Rule and ongoing state investigations into previous data breaches within the ed tech sector.
As of 2025, the Trump administration had rescinded vital federal resources intended for bolstering school districts’ cyber defenses, which included the closure of the U.S.
Department of Education’s Office of Educational Technology and the cessation of K-12 cybersecurity initiatives provided through the Multi-State Information Sharing and Analysis Center.
As a consequence, educational nonprofits and organizations have expressed concerns that financially constrained schools might be increasingly susceptible to cyberattacks in the absence of these essential federal supports.
Source link: Cybersecuritydive.com.
