2024 State Of Ransomware In Education 92 Spike In K 12 Attacks

This article is based on research by Marcelo Rivero, Malwarebytes’ ransomware specialist, who monitors information published by ransomware gangs on their Dark Web sites. In this report, “known attacks” are those where the victim did not pay a ransom. This provides the best overall picture of ransomware activity, but the true number of attacks is far higher.

2023 was the worst ransomware year on record for Education: according to original ThreatDown research, the sector witnessed a staggering 70% surge in attacks in the past year, increasing from 129 incidents in 2022 to 265 in 2023.

260a3375db21eb884dff7d2e672eebffec57e5bf22ad148e09d538ade0365de6

The spike is further underscored by the increase in median monthly attacks. In 2022 there was an average of 11 attacks per month, but by 2023, this number leapt to 21—marking an 91% uptick in monthly attacks.

ae71956e7aece997d4bb0f485dd953ece5e6dfd70164b9bc6eec1d948ce99976

Although the attacks were carried out by several ransomware gangs, two in particular were responsible for the lion’s share of 2023 attacks (50%)—LockBit and Rhysida (a rebrand of Vice Society). The data also shows that, while ransomware attacks against education are a global phenomenon, the US (with 80% of known attacks) and the UK (with 12%) were hit the most frequently attacked countries between January 2023 and December 2023.

Let’s break down attacks on the education sector by the ransomware gangs involved, the countries of target, and which gangs attacked which countries the most.

The Threat Landscape

The top gangs that targeted the education sector between January 2023 and December 2023 include LockBit (60), Vice Society/Rhysida (44), CL0P (22), Medusa (17), and Akira (15). Together, these 5 gangs were responsible for about 81% of all Education ransomware attacks.

80c2aae2002850ba8e64d8e61f33b059f10e00b1d084b3d580ce143e527dc43b

When we look at which gangs attack educational institutions most consistently (with attacks in at least six different months), however, the data tells a slightly different story. While top gangs such as CL0P and Royal may have targeted a significant amount of educational institutions, they tend to attack a majority of their victims in just one or two months.

Again, LockBit and Vice Society/Rhysida emerge as the most consistently prolific attackers against the Education sector. Notice too that Vice Society hasn’t been active since June 2023—the same month we witnessed the rise of Rhysida.

f141c35e751dad86f75c58cd003a7d30572a134dee696fe134635b3845234864

Geographic Distribution

When we break down education sector attacks by country, it becomes clear that the US and the UK have a huge target on their back. The US, however, bore the brunt of the onslaught, with 169 reported attacks.

80ebbc9d7e345731cf2f14030d28e3b76e2911813a56aa91723d0302dc6ceec9

K-12 vs Higher Ed

In 2023, 43% of all ransomware in education attacks in 2023 targeted Higher Ed and 36% of attacks targeted K-12.

Some of the most high profile attacks on Higher Ed and K-12 in 2023 include an attack against Western Michigan University, which caused a 13-day service disruption, and against the Minneapolis School District, which resulted in over 300,000 files leaked and a $1 million ransom.

3cd90a9762d2a25c141881f20edc640569fe869bc6bc8d4027bb4f01eb51c01c

Ransomware attacks on K-12 increased 92% between 2022 and 2023, with 51 attacks in 2022 and 98 total attacks in 2023.

c856e1ee344f58e0c77c8fee50e9eec8678d404a905235c86801782d07c4d474

Ransomware attacks on Higher Ed increased 70% between 2022 and 2023, with 68 attacks in 2022 and 116 total attacks in 2023.

1794132f1e3d095e4eb93fb58182d4399727181a4fba4afd0ad68d840e391134

Looking Ahead

The reality is that tight budgets of many educational institutions force them to struggle with outdated equipment and limited staff, making education an easy target for ransomware gangs. To recap, our key findings include:

  • 2023 witnessed a worrying 70% rise in ransomware attacks on the education sector, increasing from 129 incidents in 2022 to 265.
  • The median number of monthly attacks surged by 91%, indicating a heightened and consistent threat throughout the year.
  • LockBit and Rhysida emerged as the primary attackers, responsible for about 50% of all attacks.
  • The US and the UK bore the brunt of ransomware in education attacks, with over 90% of all attacks being against these two countries.
  • Both K-12 and higher education institutions faced significant increases in attacks, with a 92% rise in attacks on K-12 and 70% in higher education, showing widespread vulnerability across all levels of the educational sector, but especially K-12.

Ready to shield your school against threats like LockBit and Rhysida?

The ThreatDown K-12 Bundle integrates AI-driven endpoint security, constant expert monitoring, comprehensive device management, and advanced mobile defense—all at a price that makes sense.


Original Source

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on “Patreon” or “Buy Me A Coffee” using the buttons below

To keep up to date follow us on the below channels.