Estimated reading time: 5 minutes
School ransomware attacks rose 54% in the third quarter, Comparitech reports. When gangs take student records, a child’s stolen identity can go unnoticed for years. Parents can freeze a child’s credit for free.
A child’s stolen identity can sit unused for years. Children rarely have credit reports, the Federal Trade Commission (FTC) says. A family may not learn of the theft until the child first applies for credit.
Schools hold children’s records, and ransomware gangs are hitting schools more often. School ransomware attacks rose 54% in the third quarter of 2026, to 77 from 50, Comparitech found.
Most of those attacks are claims made by the gangs. Comparitech counted 25 as confirmed, meaning the school disclosed the attack or acknowledged an incident matching the claim. The other 52 are claims the targets have not acknowledged. Some may be false, Comparitech says.
Comparitech reviews consumer security and privacy products. Its head of data research, Rebecca Moody, wrote the roundup.
Student Data In School Ransomware Attacks
Spokane Public Schools in Washington has “reason to believe student and staff data were compromised,” GovTech reported. The district has not said what data. The NightSpire gang claimed the attack, Comparitech says.
Springfield Public Schools in Massachusetts closed for four days after an attack around Labor Day. The breach appears to include student information, officials said, WBUR reported. The breach could also include staff Social Security numbers, officials said. Officials said student Social Security numbers are not commonly kept in those files. The Interlock gang claimed it stole 1.28 terabytes.
Colleges hold large stores of personal data too. Monmouth University in New Jersey has now confirmed 164,041 people affected by a February attack, Comparitech says.
The worst case came from a school software provider. A hacker stole data on 62.4 million students and 9.5 million teachers from PowerSchool, BleepingComputer reported. The stolen data included Social Security numbers and medical information. Matthew Lane threatened to leak the Social Security numbers of children as young as five, prosecutors said, The Record reported. A judge sentenced Lane, then 19, to four years in prison in October 2025.
What Parents Can Do About Child Identity Theft
Parents and guardians can freeze the credit of a child under 16 at the three national credit bureaus. Placing and lifting a freeze is free under a 2018 federal law, the FTC says. A freeze makes it harder for thieves to open new accounts in the child’s name.
Districts that suffer a breach often offer credit monitoring. Springfield is arranging free credit monitoring for its staff, officials said. Monitoring watches an existing credit file. For most children, there is no file to watch, which is why the FTC points parents to a freeze.
The Cost Of School Ransomware Attacks
Downtime is the immediate bill. Southeastern Oklahoma State University closed for three days. Newton County Schools faced more than a week of disruption. Brazosport College restored most services after about 10 days, and Westfield Public School District faced about two weeks of disruption.
Higher education took most of the increase. Attacks on colleges and universities rose 88%, to 45 from 24. Attacks on K-12 schools rose 24%, to 31. U.S. attacks nearly tripled, to 31 from 11.
The median ransom demand fell to $510,000 from $583,000. Comparitech confirmed no ransom payments in the quarter. Five schools said they had not met their attackers’ demands.
Two gangs made more than a quarter of the claims. Qilin claimed 12 attacks and The Gentlemen 9. MITRE added The Gentlemen to its ATT&CK catalog of attacker groups this month.
The longest damage can outlast the attack. Lincoln College in Illinois closed after 157 years, citing a ransomware attack and the pandemic. Cyberwrite counted it among the small organizations whose losses ran far past any typical insurance claim.
For schools, the bill comes in downtime and notification letters. For families, the cost of a stolen child’s identity can surface years later.
FAQ – School Ransomware Attacks
How many schools were hit by ransomware in Q3 2026?
Comparitech counted 77 attacks on schools and colleges worldwide, up 54% from 50 in Q2. Only 25 were confirmed by the targets.
Why is a child’s stolen identity hard to spot?
Children rarely have credit reports, the FTC says, so misuse may not surface until the child first applies for credit, sometimes years later.
Can parents freeze a child’s credit?
Yes. Parents and guardians can freeze the credit of a child under 16 at the three national credit bureaus. It is free to place and lift.
Is credit monitoring enough after a school breach?
For most children, no. Monitoring watches an existing credit file, and most children do not have one. A freeze blocks new accounts.
Which gangs attack schools most?
Qilin claimed 12 attacks on schools and colleges in Q3 and The Gentlemen claimed 9, according to Comparitech.
Do schools pay ransoms?
No payments were confirmed in Q3. Five schools said they did not meet their attackers’ demands. The median demand was $510,000.
Related Cyber Insurance Posts
- Vulnerability Counts Doubled. Exploited Flaws Rose 37%, Talos Says.
- Beyond Social Media’s Risks: Identity Theft Targets Kids Online(Opens in a new browser tab)
- Cybersecurity Increasingly Important for Credit Ratings: S&P (Opens in a new browser tab)
- New York Attorney General Secures $3.5 Million from Marymount Manhattan College to Protect Students’ Online Data(Opens in a new browser tab)
- Cybersecurity Increasingly Important for Credit Ratings: S&P (Opens in a new browser tab)