UK education sector at higher risk of cyber attack than other UK businesses – and what the ICO has to say
Last week, the UK government published a letter sent to all FTSE100 and FTSE250 companies, and other leading UK firms.
This was prompted by the very significant increase this year in hostile cyber activity targeting UK organisations, as reported by the news media.
Cybercrime is growing more intense, frequent and sophisticated, and regrettably that trend is unlikely to decrease in the years ahead.
The government’s letter, having identified how this presents significant financial and social harm to UK businesses and citizens, and a direct threat to economic and national security, recommends three actions for large organisations to improve their cyber resilience.
For smaller organisations, a free Cyber Action Toolkit is available from the National Cyber Security Centre (NSCS) to help protect against cyber threats.
What about the education sector?
In June 2025, the UK government’s Cyber Security Breaches Survey reported that educational institutions were more likely to face a cyber-attack or security breach than businesses in the private sector, having found that:
- 6 out of 10 secondary schools suffered an attack or breach over the past year.
- This average rose to 8 out of 10 for further education colleges, and 9 out of 10 for higher education institutions.
- By comparison, only 4 out of 10 businesses experienced a breach or attack (roughly the same ratio as primary schools).
Ransomware attacks have become increasingly commonplace. Typically, cyber criminals penetrate an organisation’s IT systems and steal a copy of all data before then encrypting everything stored on the system – after which they demand a payment in bitcoin within a set timeframe for decrypting the files to make them useable again, and promising to destroy or return the stolen data. If ransom is not paid, they threaten to publish or release copies of the stolen data. It has been reported that West Lothian Council’s education network was hit by a ransomware attack this year that involved data being taken from some of its schools.
ICO analysis of ‘insider’ cyber incidents at schools
The Information Commissioner’s Office (ICO) and NCSC are inevitably engaged when cyber incidents involve personal data breaches.
Frequently their websites report on major incidents and announce updated guidance for organisations to improve security and fulfil obligations under data protection law, in particular reporting incidents promptly.
Only last month, the ICO was prompted to communicate with the education sector via a news update on its website. It published analysis of personal data breach reports caused by ‘insider’ attacks from the education sector which happened between January 2022 and August 2024, and expressed concern on finding that:
- 57% of school insider cyber-attacks were caused by students logging in.
- Almost a third of those incidents involved students guessing weak passwords or finding them jotted down on bits of paper.
Further analysis revealed:
- 23% of incidents were caused by poor data protection practices at schools, including:
- Devices being left unattended.
- Students being allowed to use staff devices.
- Staff accessing or using data without a legitimate need.
- 20% of incidents were caused by staff sending data to personal devices.
- 17% of incidents were caused by incorrect set up or access rights to systems such as SharePoint.
Only 5% of the incidents were identified as insiders using sophisticated techniques to bypass security and network controls.
In other words, security standards in the education sector fall short of the legally required minimum standard.
What actions are expected from schools by the ICO?
These findings prompted the regulator to call for schools to improve not only their cyber security, but also their internal data protection security practices.
In particular, it reminded schools to regularly refresh data protection training (guidance from the ICO is that mandatory refresher training on data protection should be delivered at least once a year).
Those measures, it hoped, might improve current security standards by raise awareness internally of the need to protect school systems.
- General security guidance from the ICO for UK organisations is available here.
- There is also bespoke advice and practical resources for schools available from the UK’s National Cyber Security Centre (‘Cyber Security for Schools’).
For further information about any of the services available from Navigator, contact Sean Morris, Legal Manager at sean.morris@navigatorlaw.co.uk.