The U.K.’s education sector faced a surge in cyber incidents driven by student hackers, with 215 insider threat breaches reported between January 2022 and August 2024. In one case, three Year 11 students exploited downloaded tools to hack their school’s information management system, citing curiosity and skill-testing as motives. Another incident involved a student using a staff login to access, modify, or delete personal data of over 9,000 individuals—including staff, students, and applicants—before the breach was reported to police. The attacks were primarily motivated by dares, notoriety, or revenge, with only 5% involving sophisticated techniques. Poor data protection practices, such as unattended devices and unauthorized student access to staff systems, exacerbated vulnerabilities. While most breaches stemmed from reckless behavior rather than malicious intent, the incidents exposed sensitive personal information, risking reputational damage and potential long-term harm to affected individuals. The ICO emphasized the need for parental guidance and redirection of tech-savvy youth toward legal cybersecurity careers to mitigate future risks.