That’s the warning from the Information Commissioner’s Office (ICO), which has spotted a worrying pattern behind the culprits responsible for school personal data breach reports that relate to insider attacks.

The regulator analysed 215 personal data breach reports caused by insider attacks from the education sector between January 2022 and August 2024, with a start set of findings in the near-two-year period.

Over half (57%) of cyber incidents were caused by students, the research found. Three in ten (30%) were caused by stolen login details, with student responsible for 97% of these attacks.

The warning comes after the National Crime Agency (NCA) reported one in five children aged 10 to 16 have been found to engage in illegal activity online. Shockingly last year, the youngest referral to the NCA’s Cyber Choices – a national programme helping people use cyber skills in a legal way – was a seven-year-old child.

Teen hackers are commonly English speaking males and around 5% of 14-year-old boys and girls admit to hacking. A number of reasons are cited as to why children hack including dares, notoriety, financial gain, revenge and rivalries.

“Whilst education settings are experiencing large numbers of cyber attacks, there is still growing evidence that ‘insider threat’ is poorly understood, largely unremedied and can lead to future risk of harm and criminality,” Heather Toomey, principal cyber specialist at the ICO, said.

“What starts out as a dare, a challenge, a bit of fun in a school setting can ultimately lead to children taking part in damaging attacks on organisations or critical infrastructure.

“It’s important that we understand the next generation’s interests and motivations in the online world to ensure children remain on the right side of the law and progress into rewarding careers in a sector in constant need of specialists.”

Further analysis of the 215 education sector insider attack breach reports found that nearly a quarter (23%) of incidents were caused by poor data protection practices. These included: staff accessing or using data without a legitimate need, devices being left unattended, and students being allowed to use staff devices.

A fifth (20%) of incidents were caused by staff sending data to personal devices, and 17% of incidents were caused by incorrect set up or access rights to systems such as SharePoint.

Just 5% of incidents were identified as insiders using sophisticated techniques to bypass security and network controls.

Recommended

• Teenage Hackers with Lapsus$ Group Convicted for Cyber-attacks
• Why Are Young People Becoming Cyber-criminals?
• Four Arrested in Investigation Into UK Retail Cyber-attacks

Schools As Part of the Solution

The impact and severity of an insider attack can be far reaching. The ICO is calling on schools to be part of the solution by taking steps to improve their cybersecurity and data protection practices and remove temptation from students.

Schools should regularly refresh GDPR training to raise standards and awareness of the need to protect access to school systems. And when things go wrong, schools must report to the ICO to ensure they receive support and advice.

Advice for Parents

The ICO continues to encourage parents to have regular conversations with their children about what they get up to online and discuss the choices they are making.

What can be perceived as a bit of fun for a young mind could turn into illegal and harmful activity with far reaching consequences.

The NCA’s Cyber Choices programme provides resources to help parents and young people explore tech skills but also understand the consequences of becoming involved in cyber crime.