UK academic institutions are under assault by hackers

The education sector is battling a torrent of cyber threats, with new research showing attacks on colleges and universities surging by 67% over the last year.

SonicWall said its threat intelligence team has recorded more than 19.3 million medium and high-severity intrusion attempts so far this year – a significant increase compared to the 11.5 million events recorded across the whole of 2025.

Most activity was concentrated in the educational services category, which accounted for 16.8 million events, or 87% of the sector total.

According to SonicWall, attackers are primarily probing web-facing education infrastructure. Path traversal and directory manipulation attacks accounted for 10.2 million hits across the four leading signatures, the company noted, while web-based attacks accounted for 17.3 million events overall.

“Education is showing us that cyber risk shows more than a ransomware gang breaking through the front door,” said Spencer Starkey, executive vice president, EMEA, SonicWall.

“We’re seeing relentless automated scanning of the systems schools and universities depend on every day, from student portals to learning platforms, as attackers look for something that has been left exposed."

Legacy vulnerabilities plague education sector

Researchers urged the sector to be on the alert for exposure to legacy vulnerabilities. Apache Log4j2 Remote Code Execution was the leading signature targeting UK primary and secondary schools, for example, generating around 660,000 hits – almost seven times as many as in the healthcare sector.

SonicWall also recorded 71,000 attempts against TFTP Server Directory Traversal signatures, targeting network boot infrastructure commonly used across school IT environments.

Despite all this activity, ransomware is still pretty rare. Just 36 ransomware events were detected across SonicWall’s UK education sensor fleet, the lowest level of any UK sector.

“The low number of ransomware events is encouraging, but it shouldn’t create a false sense of security," said Starkey. "If attackers find an unpatched vulnerability, exposed directory or overlooked network service, that initial intrusion can quickly become a much bigger problem.”

Growing threats to education sector

Earlier this year, a government report revealed that more than seven-in-ten secondary schools, nearly nine-in-ten further education colleges and almost every higher education institution in the UK had experienced a breach or attack in the last 12 months.

Primary schools came off more lightly, but half still reported experiencing a breach or attack. Phishing was overwhelmingly the main threat.

Just this summer, the data of around 450,000 present and former Nottingham University students was compromised in an attack claimed by the ShinyHunters ransomware group.

Other major incidents in recent years have affected Newcastle University, the University of Manchester and the University of Wolverhampton.

The National Cyber Security Centre (NCSC) offers a range of security resources for schools, with specific advice for governing boards and senior leaders, school staff and admin teams, procurers and providers.

In May, the government launched a dedicated cybersecurity hub for the education sector. It's aimed at helping educational organizations strengthen their cyber resilience, prepare for cyber incidents and respond effectively when attacks happen, the Department for Education (DfE) said.

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.