Ransomware Attacks on Schools Persist in 2025, Despite Slight Decline in Volume In 2025, ransomware attacks on educational institutions saw a marginal decrease in frequency but a sharp rise in severity, according to Comparitech’s Education Ransomware Roundup report. Cybercriminals targeted schools 251 times down only slightly from 240 incidents in 2024 yet the scale of data exposure grew, amplifying the impact on affected organizations. K-12 schools emerged as the most vulnerable targets, despite higher education institutions traditionally holding larger data troves. Limited cybersecurity resources and understaffed IT teams made primary and secondary schools prime targets, exposing sensitive student records, staff information, and financial data. The report highlights a critical gap in defenses, leaving smaller institutions disproportionately at risk. A major driver of breaches in 2025 was a zero-day vulnerability in Oracle E-Business Suite, exploited by the CLOP ransomware gang in August. The flaw led to data compromises at over five schools, underscoring persistent risks from unpatched software and supply-chain weaknesses. While attack volumes remained steady, ransom demands dropped significantly. The average minimum demand fell to $464,000 in 2025, down from $694,000 the previous year. Researchers suggest this shift may reflect a tactical adjustment by attackers, who recognize that lower demands increase the likelihood of payment from budget-constrained schools. The report also raises concerns about third-party mediators in ransom negotiations. Some intermediaries, who take a percentage of paid ransoms, may inadvertently encourage payments, fueling the ransomware economy. Comparitech’s Head of Research, Rebecca Moody, notes that many schools avoid disclosing attacks due to stigma, hindering collective defense efforts. Greater transparency, she argues, could help institutions share threat intelligence and adopt stronger mitigation strategies in an evolving cyber threat landscape.