Over half of school insider cyberattacks are caused by students, says the Information Commissioner’s Office.
In a concerning new trend in the UK’s education sector, students are increasingly using their digital skills to launch cyberattacks on their own schools.
This is the warning issued by the UK’s Information Commissioner’s Office (ICO) after it analysed hundreds of recent incidents that reveal students as significant insider threats.
Alarming numbers
Between January 2022 and August 2024, the ICO examined 215 data breaches classified as “insider attacks” across the education sector.
The findings were shocking: nearly three in five incidents (128 breaches) were carried out by students attending the affected schools or colleges. Students were responsible for almost all attacks involving stolen login details – 30% of all incidents.
The attacks range from those carried out by curious students, right up to malicious data manipulation. In one case, three Year 11 students accessed school databases simply because they were “interested in IT and cyber security” and wanted to test their skills. However, a more serious incident involved a student using staff login details to view, change or delete personal information belonging to “over 9,000 staff members, students and applicants”. This breach led to the ICO and the police becoming involved.
Reasons for cyberattacks
According to ICO’s findings, students launch these attacks for various reasons including, “dares, notoriety, financial gain, revenge and rivalries”.
However, what can often start as experimentation or showing off can soon escalate into serious criminal activity with lasting consequences.
National Crime Agency research
The ICO’s findings align with National Crime Agency research that shows one in five children aged 10-16 have taken part in some form of illegal online activity.
What’s more, the NCA’s Cyber Choices programme that helps parents and children to explore tech skills without becoming involved in cyber crime, received its youngest referral last year – a child of just 7 years old.
Actions for schools
The ICO doesn’t place the blame only on students, however. It says around 25% of education sector insider breaches resulted from poor data protection practices, including staff sending sensitive information to personal devices.
To secure themselves online, the ICO recommends that schools improve their cybersecurity defences and data protection training while removing temptation from students.
Reference
- Information Commissioner’s Office (2025) ‘Insider threat of students leading to increasing number of cyber attacks in schools’. Available at: Insider threat of students leading to increasing number of cyber attacks in schools | ICO (Accessed: 23 September 2025)
