Hackers Breach Dozens of Universities and K-12 Schools in Sweeping Ransomware Attack, Demanding Millions

A Wave of Cyber Terror Hits the Education Sector

A highly organized ransomware group has launched a coordinated cyberattack against more than 30 colleges, universities, and K-12 school districts across the United States and Europe, encrypting critical data and demanding ransoms ranging from $500,000 to $5 million per institution, cybersecurity officials confirmed Thursday.

The attacks, which began surfacing over the past two weeks, have disrupted academic operations at institutions in at least nine U.S. states, as well as universities in the United Kingdom, Germany, and Canada. Affected schools reported sudden system outages, locked student portals, inaccessible financial aid databases, and the encryption of years worth of academic research.

This is one of the most aggressive and far-reaching ransomware campaigns we have ever seen targeting the education sector, said a senior official at the Cybersecurity and Infrastructure Security Agency (CISA). The scale and coordination of these attacks suggest a well-resourced, state-adjacent threat actor.

Who Is Behind the Attacks?

Cybersecurity researchers have attributed the campaign to a group calling itself BlackCurriculum — a newly emerged threat actor believed to operate out of Eastern Europe. The group has claimed responsibility for the attacks on a dark web forum, posting partial samples of stolen data as proof of access and warning that all encrypted files will be permanently deleted if ransoms are not paid within 72 hours.

BlackCurriculum tactics mirror those used in previous high-profile ransomware campaigns, including the use of double extortion — first encrypting data, then threatening to publicly release sensitive student records, Social Security numbers, health information, and proprietary research unless payment is made.

The FBI has confirmed it is actively investigating the campaign and has urged all affected institutions not to pay the ransom, warning that payment does not guarantee data recovery and may embolden further attacks.

What Data Was Stolen?

According to cybersecurity firms responding to the incidents, the breached data includes student personal information including names, addresses, and Social Security numbers, financial aid records including FAFSA data and student loan information, medical and mental health records from campus health centers, faculty research data including unpublished academic papers and proprietary scientific findings, payroll and HR records for thousands of staff members, and login credentials for university email systems and learning management platforms.

At one major Midwestern university, hackers reportedly accessed over 400,000 student records dating back more than a decade. Another institution in the UK had its entire medical research database locked, threatening years of clinical trial data.

How Did the Hackers Get In?

Investigators say the attackers exploited a combination of vulnerabilities, including unpatched software in widely used student information systems, phishing emails targeting administrative staff, and weak or reused passwords on remote access portals — many of which were left exposed after schools rapidly expanded remote learning infrastructure during the COVID-19 pandemic and never fully secured those systems.

Educational institutions are among the most underprotected in the critical infrastructure landscape, said Dr. Mia Chen, a cybersecurity analyst at the Center for Digital Security Research. They hold enormous amounts of sensitive data but typically have limited IT security budgets and staff.

Schools Left in Chaos

The human cost has been immediate and severe. At affected institutions, students report being unable to access course materials, grades, or financial aid portals. Some schools have been forced to cancel classes and delay examinations. Faculty members say years of research stored on university servers is now inaccessible.

At a community college in Texas, administrators were forced to revert to paper-based operations for the first time in over a decade. A school district in Ohio reported that its payroll system was encrypted, leaving hundreds of teachers facing delayed paychecks.

Government Response

CISA issued an emergency advisory Thursday urging all educational institutions to immediately audit their network access controls, implement multi-factor authentication on all administrative systems, and apply outstanding security patches without delay.

The Department of Education announced it is working with affected institutions to provide emergency technical assistance and has established a dedicated hotline for schools impacted by the attack. Congressional lawmakers on the House Homeland Security Committee have called for emergency hearings on cybersecurity vulnerabilities in the education sector.

Senator Maria Caldwell called the attacks an act of digital terrorism against Americas children and educators and introduced legislation that would create a $500 million federal grant program to help schools upgrade their cybersecurity infrastructure.

Should Schools Pay the Ransom?

The FBI and CISA have been unequivocal: do not pay. However, administrators at some affected institutions say they are facing impossible choices — particularly when research data or student records may be permanently lost.

Cybersecurity experts warn that paying the ransom funds further criminal operations and rarely guarantees full data restoration. Paying is not a solution — it is a gamble that funds the next attack, said Marcus Webb, director of incident response at cybersecurity firm ShieldForce. The best outcome is always prevention, and the second-best is recovery from backups.

A Growing Threat to Education

The education sector has become one of the top targets for ransomware gangs over the past three years. According to data from cybersecurity firm Emsisoft, more than 1,200 schools and universities in the United States alone were hit by ransomware attacks in 2025 — a 47 percent increase from the previous year.

Experts say the trend reflects the sectors combination of valuable data, limited security resources, and a cultural resistance to treating cybersecurity as a core institutional priority.

As investigations continue and affected institutions scramble to restore operations, one message from federal officials was clear: the threat is not going away — and schools that have not yet been targeted should treat this moment as a final warning to shore up their defenses.

The New Dispensation will continue to follow this developing story. Contact our tips line at thenewdispensation17@gmail.com.