Ransomware attacks targeting higher education institutions have seen an 8% increase in the first half of 2026 compared to the preceding six months, according to a report published on July 23. This surge is largely attributed to the ransomware group known as The Gentlemen, which escalated its attacks on the education sector by 275% during the same period. Colleges and universities accounted for 80% of The Gentlemen's attacks within this sector.
Globally, 104 ransomware incidents affected the education sector between January and June 2026. Of these, 36 were confirmed as ransomware attacks by the victim organizations. While higher education faced a rise in incidents, the overall number of recorded attacks across the entire education sector decreased due to a 25% drop in attacks against primary and secondary schools.
The United States was the most targeted country, with 34 confirmed victims in its education sector. The United Kingdom and Brazil followed, reporting 13 and 8 victims, respectively. Universities in 17 other countries also experienced at least one confirmed ransomware attack during this period.
Beyond The Gentlemen, other prominent ransomware groups active in the education sector included Qilin, with both groups claiming 15 attacks each. LockBit claimed 9 attacks, while Interlock and Nova each claimed 6.
The median ransom demand issued to education sector victims in the first half of 2026 was $420,620, marking a 53% increase from the $275,000 median in the second half of 2025. The highest ransom demand reported was $1.9 million, following an attack on Mount Royal University in Canada.
In the Mount Royal University incident, which occurred last month, the attackers claimed to have exfiltrated over 10TB of data and deleted entire drives. A month after the attack, the university's systems remained impacted, and some data was reported as unrecoverable. This incident highlights that system encryption and data theft are not the only consequences, as data deletion can severely impede recovery efforts.
