UK ICO finds students behind majority of school data breaches

According to the UK ICO, students were responsible for the majority of data breaches affecting schools, with an analysis of 215 insider breach reports from January 2022 to August 2024 showing they caused 57% of all cases and 97% of breaches connected to stolen login details.

The findings, which describe insider threats as a significant and poorly understood risk, come as the ICO notes that education settings face large numbers of cyber attacks and highlights how weak data protection and human error drive most incidents. The ICO’s alert quotes comments from Heather Toomey, emphasising that what starts as a dare or challenge in a school setting can lead to damaging attacks on organisations or critical infrastructure.

The report also details patterns: poor data protection drives 23% of incidents, staff sending data to personal devices accounts for 20%, and 17% stem from misconfigured systems such as SharePoint, while only 5% involved insiders using advanced methods to bypass security. In a case under ICO review, three year 11 students breached their school’s system, holding data on 1,400 classmates, after testing password-cracking tools from the web.