Skip to main content
Add as a preferred source on Google


Report: Ransomware Attacks Plateau in Education Sector, While Third-Party Risks Loom Large

Key Takeaways

  • Ransomware attacks rose sharply overall but leveled off in education: Global ransomware incidents increased 32% in 2025, while attacks on education institutions rose just 2%, suggesting a temporary plateau rather than a reduced threat.
  • Ransom demands are falling, including in education: Average ransom demands declined across all sectors, with education seeing a 34% drop year over year, though nearly half of victim organizations still paid to recover data.
  • Third-party providers remain a major risk vector: Attackers increasingly target service providers to gain access to multiple organizations at once, underscoring the need for stronger vendor risk management alongside core security controls.

Ransomware attacks across the globe increased by 32% in 2025 β€” but in the education sector, attacks appeared to plateau, according to the latest research from Comparitech.

Attacks by Sector

Worldwide, the cybersecurity research firm recorded 7,419 ransomware attacks last year, compared to 5,631 in 2024. Of those 7,419, 1,173 were confirmed by the targeted organizations, Comparitech said. The rest were publicly claimed by ransomware groups on their data leak sites. The breakdown of attacks across industry sectors was as follows:

  • 6,292 attacks on businesses (up 35% from 2024);
  • 374 on government entities (up 27%);
  • 444 on healthcare companies (up 2%); and
  • 252 on education institutions (up 2%).

Comparitech noted that the relatively flat growth in attacks on education and healthcare institutions "could be due to a number of factors," such as a change of focus among attackers to the manufacturing sector (which experienced the largest year-over-year increase in attacks, at 56%), as well as increased cybersecurity awareness due to high-profile attacks in recent years.

Ransom Demands Decline

The average ransom demand across all industries in 2025 was $1.04 million, a decrease of 26% compared to 2024. In education, the average ransom demand was $456,200, down 34% from 2024. Nearly half of all companies paid the ransom to retrieve their data, according to survey data from Sophos.

Third-Party Service Providers a Key Attack Vector

"If 2025's figures have shown us anything, it's that ransomware attacks remain a dominant threat for companies of all sizes and across all industries," commented Rebecca Moody, head of data research at Comparitech, in a statement. "As we enter 2026, hackers will likely continue to exploit vulnerabilities, target key infrastructure, public services, and manufacturers, and seek to steal large quantities of data in the process. 2025's findings also highlight that hackers see third-party service providers as the perfect target because they not only give them potential access to hundreds of companies through one source but they also enable large-scale data breaches. From the crippling attack on Collins Aerospace, which disrupted travel at multiple airports across Europe, to the ripple effects of data breaches on the likes of Marquis Software Solutions and Oracle, 2025 should serve as a stark reminder that no matter how secure an organization's systems may be, they're only as secure as the third parties they use to carry out various services. So, while companies are going to want to make sure they're on top of all the key basics (carrying out regular backups, patching vulnerabilities as soon as they're flagged, providing employees with regular training, and making sure systems are up to date), it's also critical that they're vetting the third parties they use."

Find Out More

For the full report, visit the Comparitech site.

About the Author

Rhea Kelly is editor in chief for Campus Technology, THE Journal, and Spaces4Learning. She can be reached at [email protected].

Featured

  • digital data protection and cyber security

    White House Issues New AI Security Framework

    President Donald Trump has launched a new executive order aimed at maintaining United States AI leadership while addressing the security risks posed by increasingly powerful AI systems.

  • Engineering team implements digital guardrails on AI

    3 Starting Points for Integrating AI Guardrails in K-12 Districts

    As education leaders start to craft an AI policy that is both practical and flexible enough to evolve with this fast-changing technology, there is at least one principle that should be foundational: AI should serve to augment human critical thinking and creativity but never replace human interaction and decision-making.

  • Double exposure image of coin stacks on technology financial graph background

    The Budget Cut that Changes Everything in K-12

    ESSER funding, the post-COVID lifeline that enabled many districts to invest in data collection and research, is coming to an end. For districts that relied on those dollars to conduct surveys and gather community feedback, the impact is significant.

  • Teacher meeting parents discussing student progress in classroom

    Michigan's Flint Community Schools Adopts Human-Centered Approach to Fight Chronic Absenteeism

    In an effort to boost enrollment and combat chronic absenteeism, Michigan's Flint Community Schools has partnered with Concentric Educational Solutions to help address the academic, social, emotional, and environmental factors that prevent students from enrolling, re-enrolling, or attending school.