The education sector became the most targeted industry for ransomware in 2022, according to BlackFog's annual State of Ransomware report. The shift pushed schools and universities past both government and healthcare, two sectors that had previously dominated the charts.
The data, drawn from publicly disclosed incidents, shows a 48.8% jump over 2021, with 64 reported attacks on educational institutions worldwide. The United States led with approximately 45 incidents, while California bore the brunt with around nine. For security teams that support school districts, colleges, or ed-tech vendors, the numbers are a clear signal that the threat is no longer hypothetical.
How the sector got here
Schools have been soft targets for years. Tight budgets, small IT teams, and a culture that prioritises keeping classrooms open over patching servers all play into the hands of ransomware crews. The 2022 figures reflect an attacker economy that has matured around those weaknesses.
The report also shows a behavioural shift. Where ransomware operators once relied on encryption alone, 48.4% of 2022 incidents featured public extortion claims, compared with 11.6% in 2021. That is a fivefold jump and aligns with the rise of double-extortion playbooks that name and shame victims on dedicated leak sites.
Vice Society's focus on K-12 districts is notable. Student rosters, parent contact details, and staff payroll data make schools unusually rich targets, and the data does not lose value just because the school year ends. Personal information on minors has a long shelf life on criminal forums.
Our analysis
The headline number is bad, but the trend underneath is worse. Attackers are not just encrypting files any more; they are stealing them first and then demanding payment to keep them quiet. That is a fundamentally different negotiation, and most school districts are not equipped to handle it.
The trade-off is stark. Pay and you fund criminal infrastructure while funding future attacks. Refuse and you risk exposing the personal data of students, staff, and families to the dark web. This is not a binary choice anyone should face, but the current security posture of most institutions leaves little room for a third option.
Who loses? Cash-strapped districts forced to absorb rebuilding costs, reputational damage, and legal exposure. Who benefits? The criminal crews that have built leaking infrastructure around education, and—quietly—the insurers who are now repricing the risk at the sector's expense. The report notes 78% of institutions rely on cyber insurance, and underwriters are tightening terms heading into 2023.
The other thing to flag is the talent gap. Many districts cannot afford a full-time security engineer, let alone a SOC. Attackers know this. A single compromised staff laptop or a forgotten VPN appliance is often all it takes.
Who should care
| Stakeholder | Primary concern | What to check now |
|---|---|---|
| K-12 districts | Small budgets, rich student data, limited IT staff | MFA on admin accounts, immutable backups, incident response plan |
| Universities | Larger attack surface, research data, diverse user base | Network segmentation, anti-data-exfiltration controls, regular audits |
| Ed-tech vendors | Supply chain access, trusted relationships | Secure development practices, penetration testing |
| MSPs serving education | Multi-tenant exposure, cascading risk | Client network isolation, monitoring for lateral movement |
What it means for you
Pull your own exposure first. How many school districts in your portfolio meet baseline security standards—MFA everywhere, backups offline and tested, logging turned on? If the answer is unclear, start there.
Talk to your insurer now, not after a claim. Coverage that paid out in 2021 may not behave the same way at renewal. And rehearse a public disclosure. If student or parent data ends up on a leak site, the clock on notification laws starts the moment it appears.
What to watch next
Expect the 2023 numbers to keep climbing unless two things change: serious funding for baseline security in K-12, and insurers forcing minimum controls before underwriting. Watch the insurance market first. When carriers start refusing renewals, the sector will move faster than any government mandate could.
Key takeaways
- Education is now the single most targeted sector for ransomware; defenders in K-12 and higher ed should plan accordingly.
- Double-extortion (steal first, encrypt second) is now the dominant playbook, not a fringe tactic.
- Cyber insurance terms are tightening in 2023; review coverage before you need it, not after.
- Immutable backups, MFA, and anti-data-exfiltration controls are the minimum viable stack.
Frequently asked questions
Why is ransomware hitting education so hard in 2022?
Schools hold valuable personal data on students, staff, and families, and they often operate on tight security budgets with small IT teams, making them easier targets than sectors with more mature defenses.
Which ransomware group was most active against schools?
Vice Society led with nine publicly disclosed attacks, followed by BlackCat and LockBit.
Are schools paying ransoms?
The report says ransom amounts are rarely disclosed, but the share of cases where groups publicly claimed attacks jumped from 11.6% in 2021 to 48.4% in 2022, suggesting more extortion pressure.
Did any school permanently close after an attack?
Yes. Lincoln College in Illinois shut down in 2022 following a 2021 ransomware incident after surviving 157 years through multiple major crises, including the Great Fire, the Spanish Flu, and the Great Depression.
How does cyber insurance factor in?
About 78% of institutions rely on it, but the report warns that policy terms are tightening in 2023, so current coverage may not behave the same way at renewal.
Inspired by reporting from: blackfog.com