Education ransomware attacks plateaued. Records exposed jumped 27%.
The three largest education breaches of 2025 all came through one supplier flaw: Clop's exploitation of a zero-day in Oracle E-Business Suite. The British Library's published incident review remains the clearest public account of why accredited, stress-tested and routinely pentested defences were not enough.
Why Education is in the crosshairs
Five shifts shaping the education and research threat environment — why ransomware attack counts plateaued while the damage grew.
Attack volumes have plateaued, but the damage has grown
Comparitech's 2025 data is the headline: claimed ransomware attacks barely moved year-on-year (247 → 251), but records breached in confirmed attacks jumped 27%. The three largest breaches were not attacks on each institution's own network: all three came through Clop's exploitation of a zero-day in Oracle E-Business Suite, with the University of Phoenix breach alone affecting nearly 3.5 million people.
Third-party platforms now drive the biggest breaches
Student information systems (PowerSchool, Ellucian, Workday Student), learning management systems, file transfer utilities (MOVEit, Cleo), enterprise systems such as Oracle E-Business Suite, library systems, payment processors, and identity providers all hold concentrated education data. The US National Student Clearinghouse MOVEit incident in 2023 touched records from nearly 900 US colleges and universities, and PowerSchool's December 2024 incident exposed student and staff data held for school districts across the US and Canada.
Research data is a nation-state target, not just a criminal one
The ASD 2024–25 report is explicit about state-sponsored espionage targeting Australian networks. Group of Eight universities run defence research, medical research, AI research, and commercial collaborations — all high-value intelligence targets. The British Library's published incident review shows what that exposure looks like for an institution that holds research collections and data on behalf of others.
Budget constraints amplify legacy risk
Education cyber programmes run on tight budgets, and they have to cover legacy academic systems, devolved IT where faculties run their own infrastructure, BYOD-by-default on student networks, and the research-collaboration imperative to keep systems accessible to external partners. The result is an unusually wide attack surface to defend.
K-12 consequences extend beyond data loss to child safety
After the February 2023 ransomware attack on Minneapolis Public Schools, the Medusa gang published more than 189,000 stolen files from March 2023, including records of campus sexual assault cases, child abuse inquiries, student mental health crises and suspensions (The 74). In September 2025 the Radiant gang posted profiles of 20 children from the UK Kido nursery chain online, with their pictures, dates of birth and who they live with (BBC). These are safeguarding crises, not just data-loss events.
What experts are saying
Although the security measures we had in place on 28 October 2023 were extensive and had been accredited and stress-tested, with the benefit of hindsight there is much we wish we had understood better or had prioritised differently.
The three largest breaches of 2025 all stem from Clop’s exploit of a zero-day vulnerability in Oracle’s E-Business Suite software, highlighting how schools not only face the threat of ransomware attacks on their own systems but also on the third parties they rely on.
Though the motive of the attack on the British Library appears to have been purely monetary, it functioned as, effectively, an attack on access to knowledge.
University research can be SOCI Act critical infrastructure
A university whose research is critical to national security, the defence of Australia or another critical infrastructure sector is a critical education asset under the SOCI Act, bringing mandatory cyber incident reporting and the duty to notify data storage or processing providers. The CIRMP does not currently apply.
Higher education and research is one of the SOCI Act's critical infrastructure sectors, but its obligations are narrow. A university whose research is critical to another critical infrastructure sector, the defence of Australia or national security is a critical education asset, and it carries mandatory cyber incident reporting and the duty to notify data storage or processing providers. The CIRMP and the Register of Critical Infrastructure Assets do not currently apply to it. Universities can still adopt a recognised cyber framework, such as the Essential Eight, NIST CSF or ISO 27001, to manage the cyber risk behind those incidents.
Universities also face obligations under TEQSA. Standard 7.3.3 of the Higher Education Standards Framework (Domain 7, Representation, Information and Information Management) requires providers to maintain information systems and records securely and confidentially, and meeting the Threshold Standards is a condition of registration. TEQSA is a quality regulator rather than a cybersecurity standard — its requirements don't map to specific technical controls the way the Essential Eight or ISO 27001 do, which is why it doesn't have its own compliance page on this site. That said, TEQSA states that it expects providers to establish and enact measures to identify and manage cyber security risks, and that senior management and governing councils stay abreast of existing and emerging threats. Testing your IT systems against real attack conditions gives you evidence that supports the institution's obligations under Standard 7.3.3(b).
Private universities and the Australian National University are covered by the Privacy Act 1988; other universities and public schools sit outside it and are generally covered by state or territory privacy law. The Cyber Security Act 2024 requires 72-hour ransomware payment reporting from the entities it covers, and the Defence Trade Controls Act 2012 applies to institutions involved in controlled research. ARC grant applications now pass through strengthened security screening that looks closely at foreign affiliations and funding.
Federal legislation that names higher education and research as a critical infrastructure sector. Critical education assets carry mandatory cyber incident reporting and must notify their data storage or processing providers; the CIRMP does not currently apply to them. NodeZero tests the student, research and administrative networks behind those assets.
Private universities, the ANU and non-government education providers covered by the Act must protect student, staff and research participant personal information under the Australian Privacy Principles.
Where NodeZero applies
Applies to institutions processing tuition fees, accommodation payments, and other student transactions via payment cards.
Where NodeZero applies
ASD's prioritised mitigation strategies, which a university can adopt voluntarily as a technical baseline.
Where NodeZero applies
A risk-based framework a university can adopt to structure its cyber program across research, teaching and administration.
Where NodeZero applies
A certifiable information security management standard a university can adopt to govern research data and demonstrate security to international partners.
Where NodeZero applies
72-hour ransomware payment reporting for businesses over $3M turnover (Commonwealth and State bodies excluded) and for SOCI Part 2B responsible entities, including universities responsible for a critical education asset.
Where NodeZero appliesA cascade of new obligations
Multiple new regulatory requirements are hitting simultaneously — each increasing the compliance burden and the consequences of failure.
SOCI Act — higher education and research assets
In forceA university whose research is critical to another critical infrastructure sector, the defence of Australia or national security is a critical education asset under the SOCI Act. It carries mandatory cyber incident reporting and the duty to notify data storage or processing providers. It is asset-specific, not sector-wide, and the CIRMP does not currently apply.
Cyber Security Act 2024
30 May 2025Ransomware payments must be reported within 72 hours by businesses with turnover over $3M and by SOCI Part 2B responsible entities. The turnover test excludes Commonwealth and State bodies, such as a body established for a public purpose under a state law, but a university responsible for a critical education asset is captured as a Part 2B responsible entity.
ARC security screening strengthened
1 Jul 2024ARC schemes opened for applications after 1 July 2024 carry strengthened security screening: earlier checks, broader open-source evidence on researcher affiliations and funding, and firmer disclosure of foreign affiliations. Under section 47(8) of the ARC Act the Minister can refuse funding for security, defence or international relations reasons, and in May 2026 the Minister told Parliament he had refused funding for 13 applications.
TEQSA information security obligations
In effectStandard 7.3.3(b) of the Higher Education Standards Framework requires providers to maintain information systems and records securely and confidentially to prevent unauthorised or fraudulent access. Maintaining information security was one of TEQSA's five compliance priorities in 2022, the year TEQSA received an unprecedented number of cyber security incident notifications from providers.
Find your organisation
See how the changes affect you specifically
Universities
Australia's 42 universities and New Zealand's eight. TEQSA governance requirements, active research programmes requiring security screening, and SOCI obligations for critical research assets.
View details →TAFE & vocational providers
State TAFEs and thousands of private RTOs. Highly distributed campuses with limited dedicated cybersecurity staffing and high student turnover.
View details →K-12 education departments
State education departments and Catholic and independent school networks, running centralised IT across Australia's 9,600+ schools and 4.1 million students (ABS Schools 2025).
View details →Why security teams trust NodeZero
Prove your network resilience before the next semester starts
See how NodeZero discovers attack paths across your education environment