A third of UK universities have admitted to having fallen victim to a ransomware attack. This represents more than 25% of universities and colleges in the country.
The incidents occurred over the past decade, most from 2015 to 2017. Several educational institutions have suffered at least two attacks in the past decade, one of which records more than 40 since 2013.
Digital PR and SEO agency TopLine Comms posed a question to 134 universities in the UK, asking whether they had experienced a ransomware attack, when it happened, whether or not they paid the ransom , and what was the amount they were asked for.
Of the 104 organisations that responded, only 35 admitted to having been the victim of such an incident in the last ten years, the results from TopLine Comms show, and 42 refused to comply with the request citing section 31.1.a of the Freedom of Information Act, which refers to the “prevention or detection of crime”.
Many of the universities that confirmed a ransomware attack reported experiencing attacks multiple times, with Sheffield Hallam University reporting a record number: 42 in the last seven years.
City, University of London (CUL) also recorded a higher number of such incidents: seven since 2014, the last two occurring in February 2017.
The schools reporting the most recent ransomware attacks are the University of West London, which experienced ransomware incidents twice in early 2020, followed by Huddersfield with two incidents in June and September 2018.
The ransom was not paid
On the other hand, most of the respondents who confirmed falling victim to ransomware attacks stated that they did not pay ransom to the attackers, indicating that they restored the affected systems from backups, although some were more cautious and refused to answer.
However, the results from the FOIA reflect recent times as nearly half of the schools that received the request refused to provide any information, citing concerns that admitting to the attack would embolden hackers.
