What cyber security vulnerabilities are found in schools and how can we address them?
Schools contain a multitude of sensitive data on children, staff and parents/carers alike. Because all schools have a wealth of this kind of data, this unfortunately makes them a target for cyber attacks – especially when coupled with other issues such as limited budgets, which might mean schools are using outdated software or systems that simply aren’t sufficient.
How widespread is the issue?
The Australian Information Commissioner (OAIC) noted 44 notifiable data breaches in domestic educational organisations in just the first half of 2024. 1
Some specific examples include an incident at Western Sydney Australia where sensitive data of staff and students was exposed and “an attack on the Department of Education in Western Australia disrupted services, causing delays in communications and access to essential systems for weeks.” 1
Both of these attacks highlighted vulnerabilities in educational systems and the scale and scope of cybersecurity challenges in Australia. 1
But it’s not just Australia. “During the past couple of years, cyberattacks on education and research institutions have surged globally.” 1
For example, in 2024 the UK Department for Science, Innovation and Technology shared some statistics on the number of institutions who reported cyber security breaches or attacks over 12 months, and found reports from:
- 52% of primary schools
- 71% of secondary schools
- 88% of further education establishments
- 97% of higher education institutions 2
Furthermore, other than primary schools (which were relatively close to businesses in terms of the number reporting attacks/breaches), all other educational establishments were more likely to have identified an attack or breach than the average UK business. 2
What can schools do about it?
- Understand their vulnerabilities: human error (e.g. sharing of passwords), social engineering (manipulation leading to disclosing of information) and system intrusions (exploitation of infrastructure weaknesses)
- Raise cybersecurity awareness
- Invest in tools and strengthen IT infrastructure
References
- School News Australia (2025) ‘Why cyberthreats are a growing challenge for Australian educational institutions’. Available at: https://www.school-news.com.au/news/why-cyberthreats-are-a-growing-challenge-for-australian-educational-institutions/ (Accessed: 18 February 2025)
- UK Department for Science, Innovation and Technology (2024) ‘Cyber security breaches survey 2024: education institutions annex’. Available at: https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2024/cyber-security-breaches-survey-2024-education-institutions-annex (Accessed: 18 February 2025)
