Nearly three in four (73%) of educational institutions have experienced at least one cyber-attack or data breach in the past five years, new research from ESET found.

About a fifth of respondents to ESET‘s survey said they experienced three or more incidents in the same time.

The revelation comes just after a UK school had to shut its doors after falling victim to a ransomware attack last week.

This aligns with government data from 2024, which found that 77% of education organisations have experienced a breach or attack in just the last year – far higher than the 50% of UK businesses overall that had been targeted.

Despite being a key target for cyber-criminals, the research found that a third of education institutions still lack fundamental protections, such as antivirus software (33%), and strong password policies (35%). Additionally, the majority (79%) have yet to adopt advanced measures like managed detection and response.

Another key but often overlooked safeguard is cyber insurance, which, according to government data, under half of primary schools (44%), and even fewer secondary schools (36%) report having in place.

Troublingly, ESET found that 7% of institutions operate without any annual cybersecurity budget at all.

The shortfall in cybersecurity protections jeopardises organisational data whilst putting sensitive student information at risk.

As cyber-criminals increasingly target educational institutions, student’s personal and academic data remain highly vulnerable to theft or misuse. Compounding the issue, one in five (21%) education organisations surveyed admit they feel unprepared or not confident to tackle the rising tide of AI-driven cyber-threats.

Recommended reading

• BCS: Too Many Young People Leaving School Without Digital Life Skills
• NCSC Offers Free Cyber-defence Service to All UK Schools
• The Unique Cybersecurity Threats Facing Education Institutions

Organisations say that they prefer to prioritise the budgets they have for cybersecurity measures (37%) when asked why they won’t take out a cyber insurance policy.

Others cited concerns about payout reliability (33%) and complex or unclear policy terms (32%). Meanwhile, 28% believe cyber insurance is too expensive, while 18% revealed they simply do not understand its value.

The report comes at a time when education organisations continue to battle familiar foes, with data breaches (61%), malware (55%) and phishing (43%) topping their list of concerns.

While the majority (76%) of education organisations believe there staff have at least a good knowledge and awareness of online safety and cybersecurity best practices, over half still plan to prioritise increasing staff awareness and training and expanding their cybersecurity tools or software over the next year.