Summary
- Comparitech recorded 77 education ransomware incidents and claims in Q3 2026, comprising 25 confirmed cases and 52 unverified claims.
- Four recorded cases involved the UK, while universities in Spain, Portugal and Romania featured among independently confirmed incidents.
- The median reported demand was $510,000, but no ransom payments were confirmed in the quarter's dataset.
Recorded ransomware incidents and criminal claims affecting educational institutions rose by 54% in the third quarter of 2026, according to research that includes attacks involving universities and other education providers across the UK and Europe.
Research company Comparitech identified 77 incidents and claims worldwide between July and September, compared with 50 during the previous quarter.
Only 25 of the third-quarter cases had been independently confirmed when the findings were published on 20 October. The remaining 52 were claims by ransomware operators that had not been substantiated by the organisations they named.
The UK accounted for four recorded cases, down from five in the second quarter. Confirmed European incidents included universities in Spain, Portugal and Romania, although the available data does not establish the same level of verification for every UK entry.
The figures describe ransomware activity recorded through a combination of public disclosures and criminal claims. They do not represent 77 independently confirmed breaches.
Higher education records a sharper increase
Comparitech recorded 45 cases involving universities and other higher education institutions during the third quarter, compared with 24 in the preceding three months.
That represents an increase of approximately 88%.
For primary and secondary education, the number increased from 25 to 31, a rise of 24%.
The two categories have different technology requirements, but both rely on systems supporting identity management, teaching, administration and access to institutional information.
Universities may additionally operate research infrastructure, departmental applications, student accommodation systems and networks used by external collaborators.
Schools and colleges can depend heavily on externally provided management platforms and a smaller group of administrative staff to maintain systems.
Disruption to these services may interfere with teaching, communications, examinations, enrolment and the handling of student records. The consequences depend on the systems affected, the academic calendar and the recovery arrangements available to the institution.
Comparitech says confirmed incidents in its dataset have involved outages lasting days or weeks, although that experience cannot be generalised to every case recorded through an extortion claim.
UK figures remain smaller than US totals
The United States accounted for 31 of the 77 cases, or approximately 40% of the worldwide total.
Its recorded number rose from 11 during the second quarter, representing a 182% increase.
Canada followed with six cases, while the UK and Brazil recorded four each.
The UK’s total decreased slightly between quarters, contrasting with the sharp increase in the US figures.
However, the size of the national totals and differences in disclosure practice limit the conclusions that can be drawn from those comparisons.
Some institutions acknowledge a cybersecurity incident without identifying ransomware, while others make no public statement after being named by a criminal group.
Countries also have different legal thresholds and practices governing disclosures about data breaches and service interruptions.
A higher count may therefore reflect both a greater volume of observed malicious activity and differences in the information available to researchers.
The four UK entries should not be presented as four confirmed ransomware breaches without further institution-specific verification.
European universities confirm separate incidents
Several European examples in the report have stronger evidence because the affected institutions acknowledged attacks or made statements consistent with ransomware claims.
Spain’s Universidad de Alicante and Portugal’s Universidade de Aveiro both confirmed that they had not paid ransom demands following incidents in July.
Comparitech says the responsible groups in those cases remained unidentified at the time of publication.
Romania’s Universitatea de Vest Vasile Goldiș din Arad was included among the confirmed attacks claimed by the Qilin ransomware group.
The same group was linked to a confirmed August attack involving Uşak Üniversitesi in Turkey, where approximately 3,000 people were notified of a data breach.
These cases provide evidence of European institutional exposure beyond the publication of names on criminal extortion websites.
Nevertheless, an institution confirming an attack does not validate every assertion made by the group claiming responsibility, including alleged volumes of stolen data or details of the initial intrusion.
Comparitech’s methodology recognises that difference by separating confirmed incidents from claims awaiting independent acknowledgement.
Criminal claims account for most of the dataset
Comparitech treats an attack as confirmed when an organisation publicly discloses ransomware involvement or acknowledges a cybersecurity incident that matches a ransomware group’s claim.
Where the organisation has not acknowledged a corresponding incident, the researchers retain the claim as unconfirmed.
An unconfirmed classification does not establish that the criminal group fabricated the incident. The organisation may have chosen not to disclose it, or confirmation may emerge later.
Equally, a published criminal claim cannot independently demonstrate that an organisation was successfully compromised.
The resulting dataset changes as investigations and disclosures progress. Cases may move from unconfirmed to confirmed, and the date assigned to an incident may change if later evidence establishes when it actually occurred.
Comparitech compiled the education report after publishing its broader third-quarter ransomware overview on 7 October.
The earlier analysis recorded 75 education cases, including 20 confirmed incidents. The subsequent sector-specific research revised the total to 77, with 25 confirmations.
Those revisions reflect the evolving evidence and mean that the two reports should not be treated as contradictory final counts.
Qilin accounts for the largest number of claims
Qilin made 12 claims against educational institutions in the quarter, while The Gentlemen accounted for nine.
Together, the two groups represented 21 recorded cases, approximately 27% of the total.
Five cases attributed to Qilin were independently confirmed, compared with two involving The Gentlemen.
INC, Panzer and KRYBIT each made four claims, although their confirmed totals differed.
The figures identify which extortion groups most frequently appeared in the researcher’s dataset. They do not establish that every claim involved successful encryption, confirmed data theft or the same intrusion technique.
Initial access methods can vary across incidents attributed to the same group, and the education analysis does not provide a verified technical reconstruction for each recorded institution.
Ransom demands and data exposure remain incompletely measured
The median reported ransom demand was $510,000, compared with $583,000 in the second quarter.
That figure reflects demands for which information was available, not an amount paid by the typical institution or an estimate of total recovery costs.
Comparitech found no confirmed ransom payments during the third quarter. Five institutions explicitly said they had refused attackers’ demands.
The researchers also identified approximately 13,000 records known to have been breached in confirmed third-quarter cases.
That is a limited known figure, rather than a full count of people affected by ransomware across the education sector.
The report illustrates delays in establishing information exposure through Monmouth University in the United States, where an incident occurred in February and a later disclosure confirmed that 164,041 people were affected.
Because that attack occurred in February, its confirmed record count does not belong in the third-quarter exposure total.
The distinction between the date of an attack and the date its consequences become known is necessary when comparing quarterly figures.
The education dataset therefore shows an increase in recorded ransomware activity, alongside substantial uncertainty over the proportion of criminal claims that will eventually be confirmed. Further statements from institutions and incident investigations may alter both the national totals and the measured impact.
