--- title: The rise of ransomware attacks in higher ed description: Concerned about the growth of ransomware in colleges and universities? You’re not alone. We’ll explore the increase in attacks and offer a solution. image: https://shardsecure.com/hubfs/iStock-862661268%20(1--resized)%20(1).jpg --- - [Home](https://shardsecure.com/) - [Blog](https://shardsecure.com/blog) # The rise of ransomware attacks in higher ed ![Picture of Julian Weinberger](https://shardsecure.com/hs-fs/hubfs/Staff%20headshots/Julian-Weinberger.png?width=60&name=Julian-Weinberger.png "Picture of Julian Weinberger") Julian Weinberger October 21 2022 ![Shot of a group of university students working on computers in the library on campus.](https://shardsecure.com/hubfs/iStock-862661268%20(1--resized)%20(1).jpg "Shot of a group of university students working on computers in the library on campus.") A troubling new trend is emerging on campuses This year, a [Sophos survey](https://assets.sophos.com/X24WTUEQ/at/pgvqxjrfq4kf7njrncc7b9jp/sophos-state-of-ransomware-education-2022-wp.pdf) of hundreds of institutions revealed that 64% of higher ed institutions were hit by ransomware in the last year. The number represents a significant increase from the 44% that reported an attack in 2021.  So far, the attacks have had a sizable impact. [Recent Comparitech research](https://www.comparitech.com/blog/information-security/school-ransomware-attacks/) notes that ransomware hit 954 schools and colleges in 2021, potentially impacting over 950,000 students. Their cost estimate for the attacks? A staggering $3.56 billion in downtime alone.  The statistics for ransomware are particularly grim in education: - While most organizations regained some of their data after paying the ransom, only 2% regained it all. - On average, schools lost four days to downtime and spent nearly a month recovering from an attack. - Attackers’ encryption success has been significantly higher than average in schools, with 74% of attacks successful in higher ed compared to the global rate of 65%. Below, we’ll discuss the growth of ransomware attacks in education. We’ll explore a few reasons why colleges and universities are being targeted so relentlessly, and we’ll suggest a solution to [mitigate attacks](https://shardsecure.com/resources/briefs/mitigate-cloud-ransomware). ## Ransomware attacks in schools: an alarming rise While higher ed may not seem like a valuable target for cybercriminals, attacks have been rising precipitously. In January 2020, a [ransomware attack at Dundee and Angus College](https://www.jisc.ac.uk/news/ransomware-attack-what-we-learned-and-how-we-recovered-29-jun-2021) in Scotland impacted the entire digital infrastructure of the college. They had to rebuild their core systems from scratch. Meanwhile, in June 2020, the University of California, San Francisco, [paid $1.1 million to attackers](https://www.forbes.com/sites/daveywinder/2020/06/29/the-university-of-california-pays-1-million-ransom-following-cyber-attack/?sh=481f0f8318a8) to regain access to their servers. And in 2022, North Carolina A&T State University, North Orange County Community College District, Ohlone Community College District, and Midland University all [reported significant ransomware attacks](https://www.forbes.com/sites/emmawhitford/2022/04/19/cyberattacks-pose-existential-risk-to-colleges-and-sealed-one-small-colleges-fate/?sh=3c49253253c2). The combined effects of the pandemic and a December 2021 ransomware attack even forced Lincoln College, a historically Black college in Illinois, to [permanently close](https://www.cbsnews.com/news/lincoln-college-closes-ransomware-hackers-illinois/). ## What makes colleges so vulnerable to ransomware? At ShardSecure, we sometimes like to quote Willie Sutton. Upon being asked why he robbed banks, Sutton responded "because that’s where the money is." Ransomware attackers target colleges and universities because that’s where the sensitive information is. Education institutions are a repository of highly sensitive and confidential material, from student grades and medical records to tuition information and payroll, that must be protected.  Ransomware can also paralyze schools’ critical operations, leaving victims willing to try almost anything to get their data back. Losing access to vital data can disrupt time-sensitive operations like college admissions and matriculation, which can in turn cause huge financial damage. That’s just what attackers want.  If that wasn’t enough, universities also have several unique vulnerabilities that make them ideal targets for cybercriminals. ### Lack of security protocols, presence, and funding Many universities' security protocols are inconsistent across their individual schools and departments. As the 2022 [Sophos report](https://assets.sophos.com/X24WTUEQ/at/pgvqxjrfq4kf7njrncc7b9jp/sophos-state-of-ransomware-education-2022-wp.pdf) bluntly put it, "the education sector is poorly prepared to defend against a ransomware attack, and likely lacks the layered defenses needed to prevent encryption if an adversary does succeed in penetrating the organization." Cybersecurity also represents a [significant expense that does not return any direct revenue](https://www.upguard.com/blog/how-colleges-and-universities-can-prevent-ransomware-attacks#:~:text=A%20recent%20Sophos%20study%20examining,and%20universities%20across%20the%20world.). Additionally, universities have much longer vacations than most organizations. [Ransomware attackers are notorious for striking during school vacations](https://therecord.media/north-carolina-at-hit-with-ransomware-after-alphv-attack/) to maximize damage while IT staff are away.  The net result? Underfunded and underdeveloped security systems that can’t withstand ransomware. ### The human element Human error is still the biggest factor in data security incidents, with a 2020 report from Stanford researchers noting that [88% of data breaches involve human error](https://blog.knowbe4.com/88-percent-of-data-breaches-are-caused-by-human-error). But with education institutions, the potential for error is compounded.  Like adults, students often use their own devices, access unsecured public Wi-Fi, and may not be aware of phishing scams. However, younger users may be more unconcerned with online security. They may also be likely to act impulsively — and that includes clicking on ransomware. ## What can higher ed do about ransomware? Like any other organization, colleges and universities can [take steps to improve their ransomware preparedness](https://www.upguard.com/blog/how-colleges-and-universities-can-prevent-ransomware-attacks#:~:text=A%20recent%20Sophos%20study%20examining,and%20universities%20across%20the%20world.) and defense plans. For instance, institutions might invest in:  - Data security solutions, including anti-malware software and backup-as-a-service - Network segmentation - Multi-factor authentication - Regular security audits - Cybersecurity insurance - Zero-trust architecture - Unifying IT services across schools in a district or departments in a college - Providing security education and training for staff, faculty, and students - And more ### Neutralize ransomware with ShardSecure The ShardSecure platform [mitigates ransomware](https://shardsecure.com/resources/white-papers/mitigating-the-impact-of-ransomware-attacks-with-shardsecure) by rendering confidential information — from student records to payroll — unintelligible and of no value to unauthorized users. This prevents ransomware attackers from publishing sensitive data in a double extortion ransomware attack.  The ShardSecure platform also offers high availability, multiple data integrity checks, and self-healing to detect tampering and automatically reconstruct affected data. This means that data can be restored when it’s tampered with, deleted, or [encrypted by ransomware](https://shardsecure.com/blog/can-ransomware-infect-encrypted-files#:~:text=Ransomware%20can%20infect%20even%20encrypted,top%20of%20the%20existing%20protection.). [Contact us today](https://hubs.la/Q01qcy1T0) to learn more about how ShardSecure can help universities mitigate ransomware and keep class in session. ### Sources [The State of Ransomware in Education 2022 | Sophos](https://assets.sophos.com/X24WTUEQ/at/pgvqxjrfq4kf7njrncc7b9jp/sophos-state-of-ransomware-education-2022-wp.pdf) [Ransomware Attacks on US Schools and Colleges Cost $3.56bn in 2021 | Comparitech](https://www.comparitech.com/blog/information-security/school-ransomware-attacks/) [A Cyberattack Hits the Los Angeles School District, Raising Alarm Across the Country | NPR](https://www.npr.org/2022/09/07/1121422336/a-cyberattack-hits-the-los-angeles-school-district-raising-alarm-across-the-coun) [A Cyberattack in Albuquerque Forces Schools to Cancel Classes | NPR](https://www.npr.org/2022/01/14/1072970219/cyber-attack-in-albuquerque-latest-to-target-public-schools) [Ransomware Attack: What We Learned and How We Recovered | JISC](https://www.jisc.ac.uk/news/ransomware-attack-what-we-learned-and-how-we-recovered-29-jun-2021) [The University of California Pays $1 Million Ransom Following Cyber Attack | Forbes](https://www.forbes.com/sites/daveywinder/2020/06/29/the-university-of-california-pays-1-million-ransom-following-cyber-attack/?sh=481f0f8318a8) [Cyberattacks Pose ‘Existential Risk’ to Colleges — and Sealed One Small College’s Fate | Forbes](https://www.forbes.com/sites/emmawhitford/2022/04/19/cyberattacks-pose-existential-risk-to-colleges-and-sealed-one-small-colleges-fate/?sh=3c49253253c2) [Ransomware Attack Shutters 157-Year-Old Lincoln College | CBS News](https://www.cbsnews.com/news/lincoln-college-closes-ransomware-hackers-illinois/) [How Colleges & Universities Can Prevent Ransomware Attacks | UpGuard](https://www.upguard.com/blog/how-colleges-and-universities-can-prevent-ransomware-attacks#:~:text=A%20recent%20Sophos%20study%20examining,and%20universities%20across%20the%20world) [North Carolina A&T Hit With Ransomware After ALPHV Attack | The Record](https://therecord.media/north-carolina-at-hit-with-ransomware-after-alphv-attack/) [Stanford Research: 88% Of Data Breaches Are Caused By Human Error | KnowBe4](https://blog.knowbe4.com/88-percent-of-data-breaches-are-caused-by-human-error) [Ransomware](https://shardsecure.com/blog/tag/ransomware) [Higher education](https://shardsecure.com/blog/tag/higher-education) ## Read on ![](https://shardsecure.com/hubfs/Picture2.jpg) June 15 2026 ### [ShardSecure MCP Secure Gateway](https://shardsecure.com/blog/shardsecure-mcp-secure-gateway-identity-aware-data-redaction-and-least-privilege-context-enrichment-for-ai-inference) [Read more](https://shardsecure.com/blog/shardsecure-mcp-secure-gateway-identity-aware-data-redaction-and-least-privilege-context-enrichment-for-ai-inference) ![](https://shardsecure.com/hubfs/Keyboard%20with%20high%20tech%20user%20map%20icons%20and%20symbols-1.jpeg) February 18 2026 | [Cloud](https://shardsecure.com/blog/tag/cloud) ### [Unstructured Data Left Exposed: A Cloud Breach That Should Worry Every Enterprise](https://shardsecure.com/blog/unstructured-data-left-exposed-a-cloud-breach-that-should-worry-every-enterprise) [Read more](https://shardsecure.com/blog/unstructured-data-left-exposed-a-cloud-breach-that-should-worry-every-enterprise) ![](https://shardsecure.com/hubfs/Keyboard%20with%20high%20tech%20user%20map%20icons%20and%20symbols-1.jpeg) November 12 2025 | [Cloud](https://shardsecure.com/blog/tag/cloud) ### [Can You Really Trust Hyperscalers with Your Data at Rest?](https://shardsecure.com/blog/can-you-really-trust-hyperscalers-with-your-data-at-rest) [Read more](https://shardsecure.com/blog/can-you-really-trust-hyperscalers-with-your-data-at-rest) ![](https://shardsecure.com/hubfs/AI-Generated%20Media/Images/Acronis%20and%20ShardSecure%20unveil%20a%20groundbreaking%20technology%20partnership%20set%20against%20a%20backdrop%20of%20a%20sleek%20modern%20office%20filled%20with%20digital%20screens%20displaying%20dynamic%20data%20flows%20The%20atmosphere%20buzzes%20with%20excitement%20and%20anticipation%20illuminated%20by%20sof-1.png) October 16 2025 | [Cloud](https://shardsecure.com/blog/tag/cloud) ### [Acronis + ShardSecure: Stronger data protection for modern threats](https://shardsecure.com/blog/acronis-shardsecure-stronger-data-protection-for-modern-threats) [Read more](https://shardsecure.com/blog/acronis-shardsecure-stronger-data-protection-for-modern-threats) ![](https://shardsecure.com/hubfs/AI-Generated%20Media/Images/The%20image%20portrays%20a%20hightech%20digital%20landscape%20filled%20with%20abstract%20representations%20of%20data%20security%20concepts%20At%20the%20forefront%20a%20glowing%20vault%20symbolizing%20advanced%20filelevel%20encryption%20stands%20tall%20surrounded%20by%20intricate%20patterns%20of%20fragmented%20data.png) October 1 2025 | [Data Sensitivity](https://shardsecure.com/blog/tag/data-sensitivity) ### [Revolutionizing Data Security: How Agentless File Level Encryption Makes Stolen Data Useless](https://shardsecure.com/blog/sensitive_data) [Read more](https://shardsecure.com/blog/sensitive_data) ![unstructured data](https://shardsecure.com/hubfs/Digital%20image%20of%20globe%20with%20conceptual%20icons.%20Globalization%20concept.jpeg) September 15 2025 | [Cybersecurity News](https://shardsecure.com/blog/tag/cybersecurity-news) ### [Elevating unstructured data security: ShardSecure® and Entrust® Join Forces!](https://shardsecure.com/blog/entrust_partnership) [Read more](https://shardsecure.com/blog/entrust_partnership) ![](https://shardsecure.com/hubfs/AI-Generated%20Media/Images/scales%20%20ransomware%20attack%20to%20pay%20the%20money%20or%20risk%20the%20attack.jpeg) July 29 2025 | [Ransomware](https://shardsecure.com/blog/tag/ransomware) ### [CISOs on Strategic Considerations in Ransomware Response](https://shardsecure.com/blog/ransomware-fine) [Read more](https://shardsecure.com/blog/ransomware-fine) ![](https://shardsecure.com/hubfs/AI-Generated%20Media/Images/Image%20for%20AI%20data%20types-1.jpeg) July 29 2025 | [Data security](https://shardsecure.com/blog/tag/data-security) ### [The Growth of AI is driving the Imperative of Securing Unstructured Data](https://shardsecure.com/blog/ai-unstructured-data) [Read more](https://shardsecure.com/blog/ai-unstructured-data) ![](https://shardsecure.com/hubfs/AI-Generated%20Media/Images/The%20image%20depicts%20a%20hightech%20digital%20landscape%20showcasing%20a%20sleek%20modern%20office%20environment%20illuminated%20by%20soft%20blue%20and%20white%20lighting%20In%20the%20foreground%20a%20large%20computer%20screen%20displays%20intricate%20graphs%20and%20charts%20related%20to%20data%20security%20while%20a%20gr.jpeg) July 22 2025 | [Data security](https://shardsecure.com/blog/tag/data-security) ### [How to make your SharePoint data of zero value in a zero day attack!](https://shardsecure.com/blog/sharepoint_breach) [Read more](https://shardsecure.com/blog/sharepoint_breach) [![ShardSecure®](https://shardsecure.com/hubfs/ShardSecure%20brand%20assets/Logo%20(2022)/ShardSecure-Logo__Horizontal--White.svg "ShardSecure®")](https://shardsecure.com/) 101 Avenue of the Americas, 9th Floor, New York, NY 10013, United States of America [![linkedin](https://shardsecure.com/hubfs/_2023/li.svg) ](https://www.linkedin.com/company/shardsecure) [![tweeter](https://shardsecure.com/hubfs/_2023/tweeter.svg) ](https://www.twitter.com/ShardSecure) [![facebook](https://shardsecure.com/hubfs/_2023/facebook.svg) ](https://www.facebook.com/ShardSecure/) [![facebook](https://shardsecure.com/hubfs/_2023/youtube.svg) ](https://www.youtube.com/@shardsecure877) © 2026 ShardSecure®. All rights reserved. [Privacy Policy](https://shardsecure.com/privacy-policy) ![websights](https://ws.zoominfo.com/pixel/62e7bb6d62a6b2008e071c83) ![](https://px.ads.linkedin.com/collect/?pid=5456580&fmt=gif) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Julian Weinberger", "url" : "https://shardsecure.com/blog/author/julian-weinberger" }, "dateModified" : "2023-09-08T14:21:45.899Z", "datePublished" : "2022-10-21T19:22:50.000Z", "headline" : "The rise of ransomware attacks in higher ed", "image" : [ "https://shardsecure.com/hubfs/iStock-862661268%20(1--resized)%20(1).jpg" ], "mainEntityOfPage" : { "@id" : "https://shardsecure.com/blog/class-is-in-session", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://shardsecure.com/hubfs/ShardSecure-Logo__Horizontal--Purple-Inverted.svg" }, "name" : "ShardSecure" } } ```