Ransomware attacks cost universities over £2M per incident

A cyber impact report by non-profit organisation Jisc revealed that ransomware attacks are rapidly rising in the UK’s higher education and IT services sectors and each attack against universities and organizations can cost in excess of £2M.

The report, published by Jisc in 2020, was updated this month to contain more anonymous case studies of organizations compromised by ransomware. Jisc provides network and IT services and digital resources supporting higher education institutions and research.

Since Jisc’s first cyber impact report, the education sector has sustained 15 major ransomware attacks in 2020, 18 in 2021, and at least three so far in 2022, said John Chapman, head of Janet policy and strategy. More than 100 UK schools were affected.

He warned that ransomware and malware were now the most serious threats to the industry, followed by phishing and social engineering. Remote working has continued even as campuses reopened following COVID lockdowns, which has posed a challenge for colleges and universities.

According to Chapman, personal data and information are increasingly held on devices outside of campuses. Protecting that data, wherever it may be, has exacerbated existing security issues and inadvertently resulted in some major security breaches.

While some universities are taking steps to improve security, such as implementing multi-factor authentication, others are more vulnerable and could be vulnerable to multimillion-pound data breaches. Many institutions, according to Chapman, do not systematically track and thus do not fully understand all costs associated with a cybersecurity incident.