“A dare, a challenge, a bit of fun:” Children are hacking their own schools’ systems, says study

A new Malwarebytes summary highlights how a growing number of school insider incidents are being driven by students, with the Information Commissioner's Office (ICO) report noting that over half of insider cyberattacks in education were caused by students. The ICO examined 215 personal data breach reports caused by insider attacks from the education sector between January 2022 and August 2024, finding that 57% were student-caused and that 97% of incidents involving stolen login details involved students.

The British National Crime Agency (NCA) reported a survey of children aged 10–16 showing 20% engage in behaviours that violate the Computer Misuse Act, with the consequences including arrest, criminal records, expulsion and limits on internet use. The article cites a Heather Toomey quote from the ICO, who warns that what starts as a dare or a bit of fun can lead to damaging attacks on organisations or critical infrastructure.

It also mentions cases where security experts have noted students altering grades or using staff credentials, and cites a 2024 PowerSchool breach linked to a 19-year-old in the US as an example of the potential consequences.