Loading story…
Sophos reported that ransomware is affecting education organizations more severely, highlighting schools and other educational institutions as increasingly pressured targets for disruptive cyber extortion. The findings were published in Sophos’s 2026 State of Ransomware in Education report and subsequently highlighted by Denmark’s DKCERT.
The report underscores the operational risk ransomware poses to education environments, where attacks can interrupt teaching, administration, and access to institutional systems and data. Education-sector leaders should prioritize tested incident-response and recovery plans, resilient backups, identity protections, and controls to limit lateral movement before an intrusion becomes an enterprise-wide outage.
See the actors and campaigns active against you right now.
1 event from the most recent confirmed update back to the earliest known activity.
Sophos published its State of Ransomware in Education 2026 report, based on responses from 226 education-sector IT and cybersecurity leaders in 17 countries whose organizations experienced ransomware during the preceding year. The report found that identity-related access methods accounted for 85% of reported education-sector ransomware incidents and that 58% resulted in data encryption.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
4 references tracked. Mallory keeps watching after this page renders.
cert.dk
Open sourcecert.dk
Open sourcesophos.com
Open sourcesophos.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Educational institutions are increasingly targeted by cybercriminals, with ransomware attacks causing significant operational disruptions and data loss. In the United Kingdom, new figures from Ofqual reveal that while more teachers are receiving cybersecurity training, schools are taking longer to recover from cyber incidents. Only 55 percent of affected schools managed to recover immediately, a decline from the previous year, and 10 percent reported critical damage, nearly double the previous rate. The impact on students and staff is severe, with some schools losing coursework and lesson plans permanently, forcing teachers to recreate resources and disrupting classes for weeks. One unnamed academy trust experienced such extensive damage that staff across the organization had to rebuild schedules and resources from scratch. The human cost is substantial, as students’ academic progress is directly affected by the loss of critical educational materials. Ofqual has responded by urging schools to strengthen their cyber defenses, emphasizing the importance of regular data backups and robust malware protection. In the United States, the South Lyon Community School District was forced to shut down schools after a ransomware attack crippled phone systems and emergency response sub-systems. Although there is no evidence that student or faculty data was compromised in this incident, the attack severely disrupted normal operations and highlighted vulnerabilities in critical infrastructure. According to the Center for Internet Security, 82% of K-12 schools in the U.S. experienced a cyber incident between July 2023 and December 2024, underscoring the widespread nature of the threat. The South Lyon attack was attributed to a well-known ransomware group, though officials have not disclosed the group’s identity. The incident demonstrates that even with increased awareness and training, schools remain vulnerable to sophisticated attacks that can bypass existing defenses. Both UK and US authorities stress that the cost of prevention, including reliable backup and recovery strategies, is far less than the cost of responding to a successful attack. The growing frequency and severity of these incidents have prompted calls for greater investment in cybersecurity measures across the education sector. The loss of access to emergency systems, as seen in South Lyon, raises additional concerns about student safety during critical events. The trend of longer recovery times and more severe outcomes suggests that attackers are employing more destructive tactics, making it harder for schools to restore normal operations. The publication of sensitive data, as referenced in other UK incidents, further illustrates the risks to student privacy and institutional reputation. As schools continue to digitize their operations, the need for comprehensive cybersecurity strategies becomes increasingly urgent. The educational sector’s unique challenges, including limited budgets and legacy systems, make it a prime target for ransomware groups seeking to maximize disruption. Authorities recommend that schools prioritize regular backups, employee training, and incident response planning to mitigate the impact of future attacks. The ongoing wave of ransomware incidents serves as a stark reminder that educational institutions must remain vigilant and proactive in defending against evolving cyber threats.
Jun 29, 2026
U.S. authorities warned that malicious cyber actors were actively targeting K-12 schools and other educational institutions as remote learning expanded, using ransomware, malware, phishing, DDoS attacks, and video-conference intrusions to disrupt classes and steal sensitive data. The joint FBI, CISA, and MS-ISAC advisory said schools had become targets of opportunity, with ransomware incidents rising sharply and commonly involving **data theft and extortion**; families observed in attacks included `Ryuk`, `Maze`, `Nefilim`, `AKO`, and `Sodinokibi/REvil`, while malware such as `ZeuS` and `Shlayer` also affected the sector. Separate reporting on criminal forums showed underground sellers offering remote access to compromised schools and universities in the U.S., U.K., Australia, Israel, and Germany, with listings priced from **$200 to $17,000** based on victim size and privilege level. The activity coincided with leaked credentials, exposed FTP servers, and student-data incidents tied to education and e-learning platforms, reinforcing concerns about weak remote-access security, exposed `RDP` and `SMB` services, end-of-life software, and third-party edtech risks; officials urged patching, MFA, network segmentation, offline backups, DDoS protections, tighter conferencing controls, and stronger vetting of service providers.
Aug 15, 2026
U.S. and European authorities warned that the **PYSA** ransomware group, also tracked as **Mespinoza**, was conducting double-extortion attacks against education and government organizations after stealing data and then encrypting Windows and Linux systems. The FBI said incidents affected higher education, K-12 schools, and seminaries across 12 U.S. states and the United Kingdom, while France's CERT-FR reported related intrusions against local government authorities. Stolen information included employment records, personally identifiable information, and payroll tax data, with victims pressured through ransom notes and threats to publish data on Tor-based leak sites. Investigations and technical analyses showed the operators commonly gained initial access through compromised or brute-forced **RDP** credentials and phishing, then expanded access with reconnaissance and post-exploitation tools including **Advanced IP Scanner**, **Advanced Port Scanner**, **PowerShell Empire**, **Koadic**, **Mimikatz**, **PsExec**, **Cobalt Strike**, **WinSCP**, **Chisel**, and **MEGA**. The malware appended extensions such as `.pysa`, `.locked`, and `.newversion`, used AES encryption with RSA-protected keys, terminated services and security tools to improve encryption success, and in some cases changed local account passwords or modified Windows legal notice settings to display ransom demands. Researchers and law enforcement said the campaign disproportionately targeted high-value organizations, especially education, healthcare, and government entities, and urged mitigations including MFA, RDP hardening, segmentation, patching, least privilege, backups, and user awareness training.
Aug 15, 2026