Summary
- Jisc identified 16,000 incidents in 2025, including seven classified as major.
- More than 144,000 sector credential combinations appeared on the dark web in Q1 2026.
- It supported organisations experiencing eight significant ransomware attacks.
The UK education and research sector recorded 16,000 cyber incidents identified by Jisc during 2025, including seven that the organisation classified as major. Jisc also found more than 144,000 username and password combinations associated with the sector on dark-web sources in the first quarter of 2026, according to an autumn briefing published on 14 October.
The figures come from Jisc's role providing digital infrastructure, connectivity and security support to universities, colleges and research organisations. They describe different forms of evidence and should not be added together. An identified security incident is not equivalent to a stolen credential combination, and neither figure establishes how many individuals suffered an account takeover.
Jisc says it supported organisations responding to eight significant ransomware attacks during the first quarter of 2026. Those cases reflect the attacks in which its teams provided assistance, not necessarily every ransomware incident across British education. Nevertheless, they illustrate how disruption of institutional systems can coincide with exposure of account material that might be used for subsequent attacks.
Universities, colleges, and research centres support students, staff, visiting academics, contractors, and external partners, often through different identity systems. Staff, temporary researchers, contractors and students access learning systems, collaboration platforms and specialist research infrastructure, often across organisational boundaries. That range can complicate account lifecycle management and the identification of devices or services that should no longer have access.
A credential pair observed in criminal markets may be stale, duplicated or unrelated to a still-active account. Researchers must also distinguish credentials stolen from individual devices from those obtained in a breach of an institution's central infrastructure. The high reported number is therefore evidence of potential exposure, not a verified count of currently exploitable passwords or successfully compromised university accounts.
The impact of an institutional ransomware incident extends beyond the availability of email. Learning platforms, admissions workflows, payroll, grant administration and laboratories can depend on shared identity, storage and network infrastructure. Isolation undertaken during an investigation can interrupt legitimate work even where core information remains intact. Research collaborations add another layer, as an incident at one institution may affect partners that rely on shared access or data flows.
Jisc's briefing frames those problems alongside changing regulatory requirements. Senior leaders must maintain oversight of information handling and operational continuity while technical teams work across inherited systems and externally supplied platforms. The presence of many small departments and research projects makes central visibility harder than a simple inventory of officially supported corporate applications might suggest.
The briefing does not publish an independently verified total of financial losses or prove that the same attackers were responsible for the cited ransomware events and credential exposures. Its contribution is an operational picture produced by an organisation that sees a substantial cross-section of the sector's security activity.
The numbers also show why different detection measures should not be collapsed into one risk trend. Jisc's incident count represents activity identified during a calendar year, while the exposed-credential total comes from a separate three-month monitoring period. Ransomware responses represent cases requiring significant assistance. Any comparison with previous years would need the same collection method and an account of changes in monitoring coverage. Nonetheless, each dataset points to a different operational pressure: incident triage capacity, the governance of passwords and authentication, and the ability to restore critical services after destructive disruption. Education providers have to plan for those pressures while continuing teaching, examinations and research work that cannot always be deferred.
Jisc's David Batho, director of sector security, presented the numbers as part of an October discussion of emerging threats and regulatory change. They provide a basis for assessing resourcing and visibility across institutions without treating every alert or exposed password as evidence of a successful breach.
