Quick Summary
In 2025, ransomware attacks against educational institutions decreased slightly to over 251 incidents, down from 240 in 2024. K-12 schools were particularly affected, often lacking the cybersecurity resources of higher education institutions. Notably, the average ransom demand fell to approximately $464,000, suggesting a strategic shift by attackers to increase payment likelihood amid growing data exposure risks.
The Securityish Brief
Ransomware attacks targeting educational institutions showed a slight decline in 2025, with over 251 incidents reported, compared to 240 in 2024. The “Education Ransomware Roundup” report by Comparitech highlights that K-12 schools were disproportionately impacted, lacking the cybersecurity infrastructure that universities typically possess. This makes them easier targets for cybercriminals, resulting in the exposure of sensitive data such as student records and financial information.
One significant factor contributing to the rise in data exposure was a vulnerability in Oracle E-Business Suite exploited by the CLOP ransomware gang through a zero-day attack. This incident affected more than five educational institutions, illustrating the systemic risks posed by unpatched software and supply-chain vulnerabilities.
Interestingly, while the number of attacks remained relatively stable, the average ransom demand decreased significantly from $694,000 in 2024 to approximately $464,000 in 2025. This shift may indicate that attackers are adjusting their strategies to target education and healthcare sectors, which often operate on tight budgets, thereby increasing the likelihood of ransom payments.
Another concerning trend is the involvement of third-party mediators in ransom negotiations. These intermediaries can inadvertently incentivize payment by taking a percentage of the ransom, which may perpetuate the cycle of ransomware attacks.
Rebecca Moody, Head of Research at Comparitech, emphasizes the importance of transparency in addressing ransomware incidents. Many schools are hesitant to discuss these attacks due to stigma, but sharing experiences could enhance collective defenses and proactive risk mitigation strategies.
Implications for Cybersecurity in Education
The slight decline in ransomware attacks does not diminish the ongoing threat to educational institutions. Schools must prioritize cybersecurity measures, including regular software updates and vulnerability assessments, to safeguard sensitive data.
As attackers continue to evolve their tactics, institutions should remain vigilant and consider investing in dedicated IT security teams and infrastructure. Collaboration and sharing of best practices among schools can also strengthen defenses against future threats.
Key Takeaways
- Regularly update software to patch vulnerabilities and reduce the risk of exploitation.
- Invest in dedicated IT security resources to enhance cybersecurity infrastructure.
- Encourage transparency about ransomware incidents to foster collective learning and defense strategies.
- Consider engaging with cybersecurity experts to assess and improve current security measures.
- Monitor ransom demands and negotiate carefully to avoid incentivizing payment to attackers.
Key Terms & Concepts
- Ransomware: In this article, ransomware refers to malicious software that encrypts files and demands payment for their release.
- CLOP ransomware gang: The CLOP ransomware gang is a group of cybercriminals known for exploiting vulnerabilities to carry out ransomware attacks.
- Zero-day attack: A zero-day attack occurs when cybercriminals exploit a previously unknown vulnerability in software before it is patched.
- Oracle E-Business Suite: Oracle E-Business Suite is a set of business applications that can be vulnerable to cyberattacks if not properly secured.
Read the original article here: https://www.cybersecurity-insiders.com/ransomware-attacks-on-schools-diminished-in-the-year-2025/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
