Report by Comparitech
Education Ransomware Roundup: H1 2026 stats on attacks, ransoms, and data breaches
Key Findings
80% (12 out of 15) of The Gentlemen’s attack claims were against higher education institutions.
Of 104 ransomware attacks on educational institutions in H1 2026, 36 were confirmed by the targeted entities.
There were 104 ransomware attacks in total against educational institutions in H1 2026.
The UK recorded 13 ransomware attacks on the education sector, a 225% increase from 4 attacks in H2 2025.
The US recorded the most confirmed ransomware attacks on the education sectorm with 12 confirmed in H1 2026.
Brazil, Poland, and Japan each had three confirmed ransomware attacks on the education sector in H1 2026.
Six of The Gentlemen’s 15 claimed ransomware attacks on the education sector were confirmed.
The Gentlemen claimed the most confirmed attacks (6) on the education sector, followed by Interlock (4) and Qilin and LockBit (3 each).
Ransomware attacks on higher education increased more than 8% from H2 2025 to H1 2026.
The Gentlemen’s attacks on education increased 275% from H2 2025 to H1 2026.
There were 68 unconfirmed ransomware attacks against educational institutions in H1 2026.
Nearly 693,000 records are known to have been breached in the confirmed education-sector ransomware attacks in H1 2026.
The median ransom demand in the education sector is $420,620, a 53% increase from $275,000 in H2 2025.
No ransom payments were confirmed in H1 2026 in the education sector, and five entities confirmed they had not met their hackers’ demands.
Qilin claimed 15 attacks on the education sector in H1 2026, a 38% decrease from 24 claims in H2 2025, with three of Qilin’s attacks confirmed.
Attacks via LockBit on the education sector increased 29% and attacks via Nova increased 50% in H1 2026 compared to H2 2025.
34 of 104 attacks (33%) in H1 2026 targeted educational institutions in the US, a 44% decline from 61 attacks in H2 2025.
Attacks on K-12 decreased 26% from H2 2025 to H1 2026.
Interlock had six claims in H1 2026 versus seven claims in H2 2025, with four of Interlock’s attacks confirmed on the education sector.
The Gentlemen and Qilin each claimed 15 attacks on the education sector; LockBit claims 9 attacks; Interlock and Nova each claim 6 attacks.
Brazil recorded 8 ransomware attacks (a 33% increase) and Thailand recorded 5 attacks (a 150% increase) on the education sector in H1 2026.
Attacks on the education sector dropped by 13% from 120 attacks in H2 2025 to 104 attacks in H1 2026.