Research from Comparitech has revealed that in 2025, ransomware gangs took credit for 251 cyberattacks on schools, universities and other educational institutions.
While similar to 2024’s figure (247), 2025’s attacks resulted in the breach of over 3.96 million records, a significant increase from 2024 (3.11 million).
So far, 94 of the attack claims from 2025 have been confirmed by the targeted organisations. This is lower than the figure noted in 2024 (133), but as many breaches are reported some time after attacks take place, Comparitech expect 2025’s figures to rise in the coming months.
One figure that declined from 2024 to 2025 was the average ransom demand in the education sector. It dropped by 33% from US$694,000 in 2024 to US$464,000 in 2025.
Qilin claimed responsibility for the most attacks on the education sector in 2025 with 37 in total. It was followed by SafePay (23), Fog and Interlock (18 each), and INC (17).
The US accounts for just over half of all the attacks Comparitech logged on the education sector in 2025 with 130 in total.
In second place for the number of attacks was the UK with 12 ransomware attacks on schools in total, followed by France, Brazil and Japan (nine each), Canada (eight), and Australia and Spain (seven each).
Some countries saw significant increases. For instance, Spain was up 650%, Japan 350% and Australia 250%, while the UK saw the biggest decline out of all these countries decreasing by 50%.
