Schools and colleges across England are experiencing fewer cyber attacks and are getting better at dealing with the fallout when they do.

New data from exams regulator Ofqual shows that 27% of schools experienced a cyber incident during the 2025 to 2026 academic year, down from 29% in the previous year and 34% in 2023 to 2024.

And when incidents do occur, schools are recovering more quickly, with 66% able to recover immediately, up from 55% in the previous year. Critical damage from attacks has also fallen, down to 7%.

“It’s encouraging to see schools recovering faster, but a cyber breach can still cause real uncertainty for students if coursework or marks are lost, and staff confidence can be affected long after systems are back online,” said Amanda Swann, Ofqual’s executive director of delivery.

When asked who is primarily responsible for cyber security, 46% of teachers said their IT team, 40% said all staff, and just 9% said it was senior leadership.

But, said Swann, “Cybersecurity isn’t just an IT problem; it’s a leadership responsibility. Regular backups and a clear response plan can make a huge difference when things go wrong.”

More than half of the secondary schools surveyed, 55%, have already taken action to protect against cyber attacks, with measures including implementing a cybersecurity policy, carrying out risk assessments, and setting up backup and recovery procedures.

Education is one of the most frequently attacked sectors. Schools and colleges hold large amounts of personal data on both pupils and staff, while low budgets mean that cybersecurity is often underfunded.

Earlier this week, SonicWall urged educational establishments to beware of exposure to legacy vulnerabilities. Apache Log4j2 Remote Code Execution, for example, was the leading signature targeting UK primary and secondary schools last year, generating around 660,000 hits.

There were also 71,000 attempts against TFTP Server Directory Traversal signatures during the year, targeting network boot infrastructure that’s widely used in school IT environments.

Earlier this year, an attack on the C2K system, which provides access to coursework, teaching materials, exam revision tools and communication platforms, affected more than 30 schools across Northern Ireland, leaving staff and pupils unable to access services.

Last year, West Lothian council’s education network was hit by a ransomware attack that saw the loss of data from a dozen schools.

According to the Information Commissioner’s Office (ICO), it’s often the pupils themselves who are responsible, for reasons ranging from boredom to financial gain.

Ofqual is urging schools to put more robust measures in place so staff know what to do if systems do come under fire. It recommends that educational institutions visit the Department for Education’s Cyber Security Hub for advice on how to strengthen their cyber resilience, prepare for cyber incidents and respond effectively when attacks happen.

Meanwhile, the National Cyber Security Centre (NCSC) offers security advice for governing boards and senior leaders, school staff and admin teams, procurers and providers.