UK education providers regularly identify cyber incidents, but not every reported attack is a personal-data breach. In the 2025/2026 Cyber Security Breaches Survey, 49% of primary schools, 73% of secondary schools, 88% of further-education colleges and 98% of higher-education institutions said they had identified a breach or attack in the previous 12 months. Phishing was the most commonly reported incident type. If your school or university tells you your data may be affected, ask what information was involved, follow its advice, and take prompt steps to protect any accounts that may be exposed.
What counts as a student-data breach?
A personal-data breach is a security failure that affects the confidentiality, integrity or availability of personal information. It can involve someone seeing information without permission, data being changed or deleted, or people losing access to it. Examples in education include a stolen password being used to enter an account, ransomware making records unavailable, a staff member sending records to a personal device, or information being disclosed to the wrong person.
As an Amazon Associate I earn from qualifying purchases.
A cyber attack and a personal-data breach are not interchangeable. The 2025/2026 Cyber Security Breaches Survey records institutions that identified a “breach or attack”; that category includes different kinds of cyber incidents and does not mean that every institution had a confirmed personal-data breach. ICO reporting duties concern personal-data breaches that create a risk to individuals. Some attacks may not be detected, so the survey’s figures do not capture every incident.
How common are breaches and attacks in UK education?
The Department for Science, Innovation and Technology and Home Office survey covered 273 primary schools, 222 secondary schools, 33 further-education colleges and 49 higher-education institutions. Fieldwork took place from August to December 2025, and the reported figures refer to incidents identified in the preceding 12 months.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Education setting | Identified a breach or attack | Reported incidents at least weekly | Phishing among institutions identifying an incident |
|---|---|---|---|
| Primary schools | 49% | 14% | 90% |
| Secondary schools | 73% | 20% | 96% |
| Further-education colleges | 88% | About 24% for further and higher education combined | 96% for further and higher education combined |
| Higher-education institutions | 98% | About 29% for further and higher education combined | 96% for further and higher education combined |
The weekly-incidence and phishing figures for colleges and universities are reported for further and higher education together, except that the weekly figures are given separately as approximate values for further and higher education. They should not be read as separate phishing percentages for each sector. The phishing percentages also apply only to institutions that identified an incident, not to all institutions surveyed.
Further- and higher-education respondents that identified incidents also reported impersonation (79%), malware (51%), denial-of-service attacks (49%), unauthorised staff access (29%) and unauthorised student access (23%). These are reported incident types, not mutually exclusive categories, and they do not establish that personal information was exposed in every case.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What can happen to student information?
The potential impact depends on what was accessed and how the incident unfolded. In the survey, nearly half (49%) of affected further- and higher-education institutions reported a negative systems outcome. Among those institutions, 23% reported compromised accounts or systems being used illicitly, 16% reported slowed or unavailable web services, and 14% reported losing access to files or networks.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Education records can contain sensitive information as well as basic identifiers. In one ICO example, a student used a staff login to view, amend or delete information relating to more than 9,000 staff, students and applicants. The records included names, addresses, school records, health data, safeguarding and pastoral logs, and emergency contacts. The incident illustrates why access to education systems can expose more than grades or contact details; it does not mean every institution holds every listed type of record.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Can students cause data breaches?
Yes. In a release dated 11 September 2025, the Information Commissioner’s Office analysed 215 education-sector personal-data breach reports caused by insiders between January 2022 and August 2024. Students were responsible for 57% of those reported incidents. Stolen login details featured in 30% of the incidents, and students caused 97% of the stolen-login cases.
The ICO described a case in which three Year 11 students accessed a secondary-school information system containing personal information on more than 1,400 students. In another case, a student used a staff login to access records relating to more than 9,000 people. These examples show how shared, stolen or otherwise misused credentials can turn an account compromise into unauthorised access to other people’s records.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Insider incidents are not limited to students. In the ICO’s analysis, poor data-protection practices accounted for 23% of incidents, staff sending data to personal devices for 20%, incorrect system access-rights setup for 17%, and sophisticated bypass techniques for 5%. The figures describe the incidents in that ICO analysis, not all education-sector breaches.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesWhat should you do if your school or university says your data was breached?
- Read the notice and identify what is known. Check which organisation and systems are involved, what kinds of information may have been affected, when the incident happened, and whether the institution says your information was accessed, changed, lost or made unavailable. If the notice is unclear, contact the institution using an official phone number or email address you find independently.
- Secure accounts that may be exposed. If a password used for the affected account is reused elsewhere, change it on those other services too. Use a unique password for each account, and enable multi-factor authentication where available. Make these changes through the genuine website or app, not through a link in an unexpected message.
- Be alert for follow-up phishing. An attacker may use information about your school, course or incident to make a message look convincing. Do not share passwords, authentication codes or payment details in response to an email, text or call. Verify unusual requests through a trusted channel.
- Follow the institution’s specific instructions. It may tell you what information was involved, what steps it has taken, and whether it needs information from you. Keep the notification and any later updates so you can refer to the details if you need to contact the institution again.
- Raise concerns promptly. Contact the school, college or university if you see suspicious account activity or believe someone is using your information. If you are a minor, tell a parent, guardian or another trusted adult. If the institution does not address a concern, you can contact the ICO for information about your data-protection rights.
How quickly must a UK school or university report a breach?
Under current ICO guidance, an organisation must report a notifiable personal-data breach to the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. The 72-hour period is not a deadline for every cyber attack: it applies to a personal-data breach that is notifiable. The organisation should assess the breach and whether it creates a risk to people.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
The ICO says a notification should describe the nature of the breach, the categories and approximate numbers of people and personal-data records involved, likely consequences, and the measures taken or proposed to address it. If the breach is likely to create a high risk to individuals’ rights and freedoms, the organisation must also communicate it to affected people without undue delay.
The ICO’s guidance page says it is under review following the Data (Use and Access) Act coming into force on 19 June 2025. The guidance is the relevant reference for current reporting requirements; this summary is not legal advice.
What should education providers improve?
The Department for Education’s Cyber Security Hub reports that fewer than 40% of schools have a cyber-incident response plan and under a quarter use multi-factor authentication on supported cloud services. The 2025/2026 survey also found that at least seven in ten institutions had formal cyber-risk or cyber-continuity policies, but no education tier had a majority covering all 10 NCSC Steps to Cyber Security: coverage was 14% in primary schools, 23% in secondary schools, 33% in further education and 45% in higher education.
Personal-data protections are another gap. Almost half of higher-education institutions (49%) and more than a quarter of further-education colleges (27%) said employee or student personal data was stored without protections such as anonymisation or encryption. These findings describe reported practices, not the security posture of every institution.
Quick Recap
- Protect accounts and limit access: require multi-factor authentication where supported, use unique passwords, remove shared credentials, and give each person only the access needed for their role. Review access when staff or students join, change roles or leave.
- Make reporting easy: teach staff and students to recognise and report phishing, suspicious account activity and ransomware warnings. Refresh data-protection training rather than relying on a policy no one remembers.
- Secure devices and data handling: lock screens, protect staff devices from unsupervised use, restrict downloads and unapproved services, and avoid sending records to personal devices. Map what student information is held, keep it only as long as needed, and encrypt or anonymise it where appropriate.
- Prepare to respond: patch systems, monitor privileged access, and maintain tested incident-response and business-continuity plans, including out-of-hours contacts. A plan should help the institution contain an incident, assess who may be affected, restore essential services and communicate clearly.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
