Education Ransomware Roundup: Q1-Q3 2025 stats on attacks, ransoms, and data breaches

Comparitech researchers have published a detailed study looking at ransomware attacks against the educations sector for the first three quarters of 2025.

According to the study, 180 attacks on the education sector occurred in this time period. This is a 6% increase from the same period in 2024. Despite these higher figures, the last two quarters of 2025 do offer a more positive outlook for the education sector, with significantly lower numbers of attacks than the previous three quarters. 

This study dives into all things education ransomware attacks — including the average ransomware demand across these attacks, which ransomware gangs were the most prolific in this sector, which countries were most impacted, as well as which attacks were the largest in this period. 

Key findings for Q1-Q3 2025

  • 180 attacks in total
  • 63 confirmed attacks
  • 117 unconfirmed attacks
  • 227,214 records are known to have been breached in the confirmed attacks
  • Average ransom demand across all attacks = $444,400 million
  • The US and UK have seen a similar number of attacks (when compared to the same period of 2024), while attacks in France have doubled and Australia, Brazil, and Spain have seen a number of attacks despite recording none in the first nine months of 2024
  • The ransomware strains that claimed the most attacks against schools, colleges, and universities were Qilin (24), Fog (18), SafePay (17), Interlock (13), and INC (12)
  • Interlock took credit for the most confirmed attacks (8), followed by Fog (7), Qilin (6), and SafePay, Medusa, Nova, and Kairos (3 each)
  • Nearly 233 TB of data was allegedly stolen across all attacks

You can read the study here: https://www.comparitech.com/news/education-ransomware-roundup-q1-q3-2025-stats-on-attacks-ransoms-and-data-breaches/

Leave a Reply

Discover more from The IT Nerd

Subscribe now to keep reading and get access to the full archive.

Continue reading