The education sector entered 2026 as one of ransomware operators’ most consistently targeted industries. A combination of structural vulnerabilities — limited security budgets, high volumes of personally identifiable data, dependence on operational continuity, and a user base that includes thousands of students and staff with varying security awareness — makes schools, colleges, and universities attractive targets across all tiers of the ransomware ecosystem.
The first half of 2026 recorded 312 confirmed ransomware attacks against educational institutions worldwide, according to aggregated data from public leak site monitoring, threat intelligence providers, and disclosed incidents. That figure represents approximately 9% of all confirmed ransomware attacks in the same period and makes education the third most targeted sector behind manufacturing and healthcare. The actual figure is higher: many school districts and smaller institutions resolve incidents through insurance claims without public disclosure.
Who Is Targeting Education
The Gentlemen
The Gentlemen, the most prolific ransomware operation of 2026 with over 600 claimed attacks in the year to date, maintains no sector-specific targeting policy. Education institutions appear consistently in their claimed victims — approximately 14% of their disclosed victims in H1 2026 were educational institutions. This reflects the group’s opportunistic, volume-driven affiliate model rather than deliberate targeting, but the outcome is the same.
Their victim profile in education skews toward mid-size school districts (5,000-30,000 students), community colleges, and regional universities — institutions large enough to justify ransom demands in the $200,000-$800,000 range but without the dedicated security teams that major research universities increasingly employ.
Qilin
Qilin’s education targeting in 2026 has a pronounced UK component. British independent schools, further education colleges, and several Russell Group universities appeared on Qilin’s leak site in H1 2026. The group’s technical sophistication — including WSL-based evasion and Chrome credential harvesting documented in earlier analysis — makes them effective against the Windows-based infrastructure most educational institutions run.
Ransom demands in Qilin’s education engagements have ranged from £50,000 to £2.1 million in documented UK cases, with a negotiated settlement rate around 35%. The group maintains a UK-specific negotiation posture, citing ICO notification obligations as leverage in negotiations with UK institutions.
RansomHub
RansomHub has specifically targeted US school districts and state university systems in 2026, with several high-profile attacks on multi-campus systems. Their approach leverages legitimate remote access tools (particularly AnyDesk and TeamViewer) combined with Veeam exploitation for backup destruction. RansomHub’s affiliate programme provides pre-built credential harvesting tooling, lowering the technical bar for affiliates targeting education.
Their most operationally impactful attack in the education sector in 2026 was against a state university system covering six campuses in Q2, which resulted in 11 days of operational disruption across registration, financial aid, and research systems.
LockBit 5
LockBit’s return under the “Chuong Dong” developer has included education targets, but the group’s post-relaunch operational security requirements and higher affiliate competency thresholds have kept their education victim count lower than H1 2025. Research universities with high-value intellectual property (particularly in pharmaceutical research, defence-adjacent fields, and technology transfer programmes) are LockBit’s preferred targets in this sector.
Attack Chain Patterns in Education
Initial Access: Credential Harvesting at Scale
The most consistent initial access vector for education attacks is compromised credentials — specifically VPN credentials and single sign-on accounts obtained through infostealer malware deployed in prior unrelated compromises. Student and staff credentials from educational institutions appear regularly on criminal marketplaces, having been harvested from personal devices infected with Lumma Stealer, Vidar, or Redline months before any ransomware engagement.
Education institutions typically have weaker MFA enforcement than corporate environments. Many still rely on username/password authentication for VPN access, and where MFA is deployed, it is often SMS-based rather than phishing-resistant. This makes the compromised credential path consistently viable.
The Research University Spearphishing Pattern
Research universities face a distinct attack vector: targeted spearphishing of researchers. Threat actors running reconnaissance on universities use academic publication records, LinkedIn, and university websites to identify researchers in high-value fields. Emails impersonating conference organisers, journal editors, or grant administrators are crafted with sufficient specificity to bypass cautious recipients.
The payload delivery mechanism that appeared in multiple 2026 university compromises uses a document download that exploits a patched vulnerability, delivered through links that pass URL reputation checks. In one documented Q1 2026 case, the spearphishing email referenced a real conference the targeted professor had submitted to, with a fake programme acceptance attachment.
Lateral Movement: Domain Compromise Through SYSVOL/NetLogon
Once inside an educational network, operators exploit the domain controller access that most schools maintain for Active Directory. SYSVOL and NetLogon shares — which contain Group Policy Objects and logon scripts — are readable by all domain members by default. Attackers use this to drop malicious scripts executed across the domain, achieving rapid lateral movement without needing elevated privileges at the initial foothold.
Older domain functional levels (Windows Server 2012 R2 is still common in K-12 environments) provide additional opportunities: legacy Kerberos configurations enable Kerberoasting and AS-REP Roasting against service accounts, many of which have passwords that have never been rotated.
The Summer Window
A recurring pattern in education ransomware is timing attacks to the summer period when institution-side security monitoring is at its weakest. Semester breaks mean fewer IT staff, reduced helpdesk capacity, and the window before system-intensive activities like registration and financial aid processing restart. Attackers who gain initial access in May or June frequently delay encryption until July or August, maximising disruption to the critical back-to-school period.
Why Education Is Structurally Vulnerable
Budget constraints are structural, not temporary. UK state schools operate on DSG funding; US K-12 districts depend on property tax revenues. Security spending competes directly with teaching staff, facilities, and curriculum resources in a way that has no commercial equivalent. The gap between what these institutions need for adequate security and what they can fund is not narrowing.
The user population is unlike a corporate environment. A school district’s “employees” include thousands of students whose personal devices connect to institutional networks, whose credentials are often shared, and who have no organisational security training. Attack surface management in this context is categorically different from enterprise security.
High-value data in under-secured environments. Student records, research data, and financial aid information make educational institutions attractive targets — the PII density is high and the data is sensitive. FERPA in the US and UK GDPR create notification obligations that add leverage to extortion demands.
Critical operational windows with no tolerance for disruption. A business can operate in a degraded state for weeks. A school district that loses access to its administrative systems at the start of term faces a crisis: payroll cannot run, students cannot enrol, federal reporting cannot happen. This creates genuine leverage for attackers.
Negotiation and Payment Patterns
The negotiation and payment rate in education differs from the broader market. Data from H1 2026 across publicly disclosed incidents suggests:
- 38% of US school districts and universities paid a ransom — higher than the healthcare sector (32%) but lower than financial services (51%)
- Average negotiated payment in K-12: $287,000 (down from $340,000 in 2025, reflecting improved negotiation leverage as organisations become more experienced)
- Average negotiated payment in higher education: $1.2M, with wide variance driven by institution size and data sensitivity
- Backup destruction rate in education attacks: 67% — attackers specifically target Veeam, Acronis, and Windows Server Backup before encryption
The high backup destruction rate is the key driver of payment decisions. Institutions that cannot restore from backups within acceptable timeframes face a binary choice: pay or rebuild manually. For a school district whose data includes years of student records, payroll history, and financial records not fully replicated in off-site backups, manual rebuild is often not viable.
Protective Measures That Are Effective at Scale
For institutions with constrained budgets, the highest-return investments are:
Immutable offline backups. A single offline backup that survives encryption eliminates the primary leverage attackers hold. Cloud-based backup services with immutability features (AWS S3 Object Lock, Azure Blob immutable storage) cost hundreds of dollars per month for most K-12 institutions — affordable even at constrained budgets if the alternative is a six-figure ransom payment.
Phishing-resistant MFA on VPN and SSO. The shift from SMS MFA to hardware keys or passkeys on privileged accounts closes the most common initial access path. For an institution of 500 staff, hardware key deployment costs approximately $15,000 — significantly less than the average ransom payment.
Privileged access separation. Domain administrator credentials used for routine administration is the lateral movement enabler. Tiered access models where domain admin credentials cannot be used for day-to-day tasks, implemented through PAW (privileged access workstations), closes the most common privilege escalation path.
Tabletop exercises focused on the summer attack timing. Institutions that have rehearsed their response to a July or August attack — when staffing is reduced — perform meaningfully better in real incidents. The rehearsal surfaces the gap between documented procedures and available personnel.
The pattern across successful education sector defences in 2026 is consistent: institutions that invested in backup resilience and MFA hardening in 2025 were attacked at the same rate but paid at a significantly lower rate. The investment isn’t preventing compromise — it’s removing the leverage that turns compromise into a payment.