Education Ransomware Statistics
80% (12 out of 15) of The Gentlemen’s attack claims were against higher education institutions.
Of 104 ransomware attacks on educational institutions in H1 2026, 36 were confirmed by the targeted entities.
There were 104 ransomware attacks in total against educational institutions in H1 2026.
The UK recorded 13 ransomware attacks on the education sector, a 225% increase from 4 attacks in H2 2025.
The US recorded the most confirmed ransomware attacks on the education sectorm with 12 confirmed in H1 2026.
Brazil, Poland, and Japan each had three confirmed ransomware attacks on the education sector in H1 2026.
Six of The Gentlemen’s 15 claimed ransomware attacks on the education sector were confirmed.
The Gentlemen claimed the most confirmed attacks (6) on the education sector, followed by Interlock (4) and Qilin and LockBit (3 each).
Ransomware attacks on higher education increased more than 8% from H2 2025 to H1 2026.
The Gentlemen’s attacks on education increased 275% from H2 2025 to H1 2026.
There were 68 unconfirmed ransomware attacks against educational institutions in H1 2026.
Nearly 693,000 records are known to have been breached in the confirmed education-sector ransomware attacks in H1 2026.
The median ransom demand in the education sector is $420,620, a 53% increase from $275,000 in H2 2025.
No ransom payments were confirmed in H1 2026 in the education sector, and five entities confirmed they had not met their hackers’ demands.
Qilin claimed 15 attacks on the education sector in H1 2026, a 38% decrease from 24 claims in H2 2025, with three of Qilin’s attacks confirmed.
Attacks via LockBit on the education sector increased 29% and attacks via Nova increased 50% in H1 2026 compared to H2 2025.
34 of 104 attacks (33%) in H1 2026 targeted educational institutions in the US, a 44% decline from 61 attacks in H2 2025.
Attacks on K-12 decreased 26% from H2 2025 to H1 2026.
Interlock had six claims in H1 2026 versus seven claims in H2 2025, with four of Interlock’s attacks confirmed on the education sector.
The Gentlemen and Qilin each claimed 15 attacks on the education sector; LockBit claims 9 attacks; Interlock and Nova each claim 6 attacks.
Brazil recorded 8 ransomware attacks (a 33% increase) and Thailand recorded 5 attacks (a 150% increase) on the education sector in H1 2026.
Attacks on the education sector dropped by 13% from 120 attacks in H2 2025 to 104 attacks in H1 2026.
Of the UK ransomware reports made (323) where the sector of the organisation was listed, the manufacturing industry (42 reports), scientific and technical sector (21 reports) and education sector (19 reports) have all been impacted.
Nearly 40% of schools feel underprepared for ransomware in 2025
Half of school IT leaders view ransomware as a serious threat to learning continuity in 2025
Nearly half the cryptomining attacks analysed by Akamai researchers targeted nonprofit and educational organizations.
Almost 40% of ransomware attacks in the US targeted the education sector
In higher education specifically, ransomware attacks were up 70% over 2022.
In 2023, Trustwave researchers monitored 352 ransomware claims against educational institutions.
According to the Malwarebytes report, 43% of all ransomware in education attacks in 2023 targeted higher education and 36% of attacks targeted K-12.
The Highline Public School district has over 2,000 staff members and 17,500 students across 34 schools. All 34 schools were closed due to a ransomware attack.
In 2023, there was a staggering 105% increase in known ransomware attacks against K–12 and higher education, surging from 129 attacks in 2022 to 265 in 2023.
The education sector saw ransomware attacks decrease by approximately 12% year-on-year in 2025.