Universities have found themselves in the firing line of cybercriminals, as ransomware attacks against higher education institutions have increased, analysis of recent incidents has revealed.
According to the Comparitech’s Education Ransomware Roundup for the first half of 2026, the number of attacks against higher education providers between January and June increased by 8% when compared with the previous six months.
The report, published on July 23, pointed to the rise of The Gentlemen ransomware operation as a key factor in the surge of attacks against the sector.
The group’s attacks on education increased 275% in the first half of 2026, compared with the second half of 2025, and 80% of the gang’s attacks against the education sector were against colleges and universities.
The Comparitech figures put the number of ransomware attacks on the global education sector during the first half of 2026 at 104. Of these incidents, 36 were confirmed as ransomware by the victim.
While the number of ransomware attacks against higher education has increased, the report also noted that the overall number of recorded incidents against the education sector has a whole has decreased. This is due to the number of attacks against primary and secondary schools decreasing by a quarter. However, this does not mean the ransomware problem has disappeared.
“This H1 report yet again emphasizes the impact one group can have on the threat landscape. While initially the dip in attacks makes for positive reading, further investigations reveal that this is largely due to one gang and its choice of target,” said Rebecca Moody, head of data research at Comparitech.
“The Gentlemen has gained immense notoriety in recent months and, as our data shows, has focused on higher education institutions,” she added.
US Education Most Targeted by Ransomware
The Comparitech data also showcased how ransomware attacks against the education sector is a global issue.
Establishments in the US were the biggest target for ransomware groups, with 34 confirmed victims, the UK and Brazil accounted for 13 and 8 victims respectively.
Universities in 17 additional countries experienced at least one confirmed ransomware attack during the period.
The prolific perpetrators of ransomware attacks against the education sector were The Gentlemen and Qilin, which accounted for 15 claimed attacks each, followed by LockBit, which claimed 9, then Interlock and Nova, which claimed 6 each.
Read More: Why Ransomware Remains One of Cybersecurity’s Most Persistent and Costly Threats
The report also noted that the median ransom demand issued to victim organizations in the education sector during the first half of 2026 stood at $420,620, up 53% from the second half of $275,000.
The largest ransom demand during the period was a demand of $1.9m, issued following an attack on Mount Royal University in Canada. A month on from the attack, the university’s systems were still impacted and attackers claimed to have stolen over 10TB of data.
“Last month’s attack on Mount Royal University also serves as a stark reminder of the drastic and far-reaching consequences attacks on education continue to have and that system encryption and data theft aren’t the only things to worry about,” said Moody.
“The hackers also deleted entire drives of data, which hasn’t just impeded the college’s ability to recover from the attack but means some data may be completely unrecoverable, too,” she concluded.
