Why schools remain one of cybercriminals’ favourite targets

Educational institutions continue to be a prime target for cybercriminals, with recent incidents in the United States and the United Kingdom highlighting the vulnerability of schools. These organizations often possess valuable data and operate with limited cybersecurity resources, making them attractive to malicious actors.

Evanston Township High School (ETHS) in Illinois was forced to close its campus for two days in early June 2026 due to a ransomware attack. The incident disrupted not only computer systems, internet, and phone lines but also critical building safety systems, including door access controls and public address systems. The school stated that these systems were essential for safe operations, necessitating the cancellation of classes, sports camps, and other activities. ETHS has reported the incident to the FBI, secured staff accounts, and engaged external cybersecurity experts to assist in system recovery. Employees have been advised to refrain from using their computers until cleared by IT and to avoid reusing old passwords. The attack also impacted the Home Access Center, a student portal powered by PowerSchool, though it is not believed to be connected to a previous PowerSchool breach in 2024. No ransomware group has claimed responsibility, and it is currently unknown if any personal data was compromised. The school anticipated reopening on June 10, 2026, after emergency systems were restored.

Shortly before the ETHS incident, Powys County Council in Wales disclosed that 13 of its schools had been targeted by hackers. This attack, identified in April but publicly announced two months later, did not lead to school closures. However, personal data belonging to pupils and staff at at least one school was accessed. The council has not named the affected schools due to the sensitive nature of the data and is directly contacting individuals to provide advice on protection measures.

Schools are considered attractive targets for several reasons. They hold sensitive information concerning children, and their cybersecurity budgets are often constrained, leaving them with insufficient defenses. Furthermore, as demonstrated by the ETHS case, many schools rely on networked systems for essential functions ranging from educational platforms to physical security. The education sector also faces internal threats, with reports indicating that pupils themselves can pose a risk by unlawfully accessing computer systems with malicious intent. Given these vulnerabilities, there is a recognized need for increased funding and expertise to bolster the cybersecurity posture of educational institutions.