19.3 million attacks and it's only September: UK education is being probed relentlessly
What happened
On 24 September 2026, threat intelligence from the security firm SonicWall showed UK schools, colleges and universities being hit by an extraordinary volume of automated attacks. The headline number is 19.3 million. That is how many medium and high-severity intrusion attempts were recorded against UK education so far in 2026. To put that in context, the figure for the whole of 2025 was 11.5 million. This year has already passed that total with three months still to go. SonicWall described it as a 67% annualised rise in intrusion activity across UK education. Most of the activity was concentrated in one place. SonicWall's Educational Services category accounted for 16.8 million events, or 87% of the sector total. The kinds of attack matter as much as the number. Around 10.2 million hits involved path traversal and directory manipulation - attempts to trick a web server into handing over files it should not. Web-based attacks made up 17.3 million events overall. One older weakness stood out. The Apache Log4j2 remote code execution flaw, first made public in late 2021, still attracted about 660,000 hits against education. That is roughly seven times the rate seen in healthcare. And one number was surprisingly low. Ransomware accounted for just 36 events - the lowest of any UK sector SonicWall tracked. Spencer Starkey, SonicWall's executive vice president for EMEA, summed it up: "Education is showing us that cyber-risk shows more than a ransomware gang breaking through the front door."
Why this matters
If you are a parent, this is not an abstract IT story. Schools hold a remarkable amount of information about your child. Names and addresses. Dates of birth. Medical conditions and allergies. Free school meal status. Safeguarding notes. Photographs. Who is allowed to collect them. In some cases, details about family circumstances that nobody outside the school should ever see. Universities hold even more, including financial details and research data. The second reason this matters is that schools are not banks. A secondary school does not have a security operations centre. It may have one or two IT staff covering everything from a broken interactive whiteboard to the firewall. Budgets are tight, and older equipment tends to stay in service longer than anyone would like. That combination - valuable data, limited defences - is exactly what automated attacks look for. And these are automated. Nobody is sitting at a keyboard picking on your child's primary school. Scanners sweep the internet constantly looking for anything that answers back with a known weakness. The low ransomware figure is genuinely interesting. It does not mean education is safe. It suggests attackers are currently more interested in quietly getting in and looking around than in locking systems and demanding money.
What the evidence actually says
It is worth being clear about what this data is and is not. These are intrusion attempts detected by SonicWall's intrusion prevention systems on UK-registered education sensors. They are attempts, not successes. A blocked attack still counts as an event. So 19.3 million does not mean 19.3 million breaches. Most of those attempts hit a wall. That is what the detection systems are for. The figures also come from one security vendor's own customer base, which is a slice of UK education rather than all of it. That is normal for threat intelligence, but it means the numbers show a trend rather than a national census. What the trend shows is still striking. Attack volume rising 67% year on year, and one year's total surpassed nine months into the next, is a real change in pressure. The Log4j2 finding is the one that should worry school leaders most. That vulnerability has had a fix available since December 2021. Attackers are still aiming 660,000 attempts a year at UK education with it - at seven times the rate they bother trying it on healthcare. Attackers do not waste effort on things that never work. The fact that they keep trying suggests unpatched systems are still out there. The 71,000 attempts against TFTP server directory traversal point the same way. TFTP is often used for network boot infrastructure - the kind of thing installed once and then forgotten.
Practical advice
For parents, there are a few reasonable things to do and a lot not to worry about. Ask the school what data it holds on your child and how long it keeps it. You are entitled to know, and a school that answers easily is usually one that has thought about it. Make sure the school has up-to-date contact details for you. If a breach ever happens, being reachable matters. Teach your child not to reuse their school password anywhere else, and especially not on games or social media. Reused passwords are how one small leak becomes a big one. Be suspicious of emails that appear to come from the school asking for payment, especially if the bank details have "changed". Ring the school office on the number you already have - never the number in the email. For school staff and governors, the practical steps are well established. Keep software patched, especially anything internet-facing. Turn on multi-factor authentication for staff accounts. Know what is connected to your network, including the forgotten devices. And check the National Cyber Security Centre's free guidance and tools for schools, which are designed for organisations without a security team. None of this requires a big budget. Most successful attacks exploit things that were already fixable.
What to know
UK education has faced 19.3 million medium and high-severity intrusion attempts so far in 2026, according to SonicWall threat intelligence published on 24 September 2026. That already exceeds the 11.5 million recorded across the whole of 2025, a 67% annualised increase. Most of it is automated web-based probing - 17.3 million web attacks, 10.2 million path traversal attempts - rather than dramatic ransomware. Ransomware accounted for only 36 events, the lowest of any UK sector tracked. The most fixable finding is that a vulnerability patched in 2021 still draws 660,000 attempts a year at education, seven times the healthcare rate. These are attempts, not breaches, and they come from one vendor's sensor network. But the direction is unambiguous, and the defences that work are mostly unglamorous: patch things, turn on multi-factor authentication, and know what is on your network. Sources: Intelligent Edu.tech, '19,300,000+ cyberattacks put UK education on alert', 24 September 2026, https://www.intelligentedu.tech/2026/09/24/19300000-cyberattacks-put-uk-education-on-alert/; SonicWall threat intelligence, UK education sector intrusion data, September 2026, https://www.sonicwall.com/; National Cyber Security Centre, cyber security guidance for schools, https://www.ncsc.gov.uk/information/cyber-security-schools This article is for general information and does not replace professional IT security or legal advice.
Related articles
Four months early: 3,880 rural premises and an £8.2 million contract
On 13 October 2026, the government announced that a rural broadband project in North Oxfordshire had finished four months ahead of schedule. The work connected…
First hearing from a police cell: £17.4 million and four force areas
On 12 October 2026, the Ministry of Justice published the government's response to Lord Leveson's review of the criminal courts. The review made 180 recommendat…
Over 1,000 weak spots found, and a minister's message to AI firms
On Monday 12 October 2026, the UK government set out a package of measures aimed at protecting the country from increasingly powerful artificial intelligence.…