The State of Ransomware in Education 2025

This year’s report unveils how education providers’ experiences of ransomware — both causes and consequences — have evolved over the past year. It also shines new light onto previously unexplored areas, including the organisational factors that left education providers exposed to attacks and the human impact of incidents on their IT/ cybersecurity teams.

Drawing on the real-world experiences of 441 IT and cybersecurity leaders, 243 from lower education and 198 from higher education institutions hit by ransomware in the past year, this report offers unique insights into: