Universities and colleges are facing an escalating threat from cybercriminals, as ransomware attacks targeting higher education institutions increased significantly during the first half of 2026. According to analysis from Comparitech’s Education Ransomware Roundup published on July 23, attacks against higher education providers rose by 8% between January and June compared to the previous six-month period.
What’s Driving the Surge in University Ransomware Attacks?
The research identified The Gentlemen ransomware operation as a primary factor behind the surge. This group dramatically escalated its targeting of educational institutions, with attacks on the education sector increasing 275% in the first half of 2026 compared to the second half of 2025. Notably, 80% of The Gentlemen’s attacks against education were directed at colleges and universities specifically.
Comparitech recorded 104 ransomware attacks on the global education sector during the first half of 2026, with 36 incidents confirmed as ransomware by the victims themselves. While higher education attacks increased, overall incidents against the education sector decreased due to a 25% drop in attacks targeting primary and secondary schools.
Which Countries and Institutions Are Most at Risk?
The United States emerged as the top target, with 34 confirmed victims among educational establishments. The United Kingdom followed with 13 victims, while Brazil accounted for 8 confirmed attacks. Universities in 17 additional countries experienced at least one confirmed ransomware incident during the period, demonstrating the global nature of this threat.
Beyond The Gentlemen, Qilin also claimed 15 attacks against the education sector, followed by LockBit with 9 claimed attacks, then Interlock and Nova, each claiming 6 attacks.
How Much Are Attackers Demanding from Educational Institutions?
The financial impact on universities has intensified substantially. The median ransom demand issued to education sector victims during the first half of 2026 reached $420,620, representing a 53% increase from the second half of 2025 when the median stood at $275,000.
The largest ransom demand during this period was $1.9 million, issued following an attack on Mount Royal University in Canada. A month after the incident, the university’s systems remained impacted, with attackers claiming to have stolen over 10TB of data. The hackers also deleted entire drives of data, severely impeding the college’s recovery efforts and potentially rendering some data completely unrecoverable.
Rebecca Moody, head of data research at Comparitech, emphasized the disproportionate impact single threat groups can have on the landscape, noting that The Gentlemen has gained immense notoriety in recent months through its focused campaign against higher education institutions.
Source: Infosecurity Magazine