Cybercriminals Are Turning Campuses Into Cash Machines
Universities are under siege. A new analysis of global ransomware incidents reveals that attacks on higher education institutions jumped 8% in the first half of 2026 compared to the prior six months. The data, compiled by Comparitech and published July 23, paints a troubling picture for college IT departments already stretched thin.
The rise is not random. It has a name: The Gentlemen.
This relatively new ransomware gang increased its attacks on education by a staggering 275% in H1 2026 versus H2 2025. And four out of every five times The Gentlemen hit an educational target, it was a college or university. The group now accounts for a significant slice of the sector’s ransomware pain.
The Numbers Behind the Campus Crisis
Comparitech’s Education Ransomware Roundup recorded 104 ransomware attacks on the global education sector between January and June 2026. Of those, 36 victims publicly confirmed the breach. The overall count for all education levels actually dropped — primarily because primary and secondary school attacks fell by 25%. That’s cold comfort for universities.
“This H1 report yet again emphasizes the impact one group can have on the threat landscape,” said Rebecca Moody, head of data research at Comparitech. “While initially the dip in attacks makes for positive reading, further investigations reveal that this is largely due to one gang and its choice of target.”
Moody added that The Gentlemen has gained immense notoriety recently by focusing squarely on higher education.
US Universities Are the Prime Target
Ransomware is a global problem, but some nations are getting hit harder than others. The United States leads the list with 34 confirmed victims. The United Kingdom follows with 13, and Brazil rounds out the top three with eight. In total, universities in 17 additional countries experienced at least one confirmed ransomware attack during the period.
The most prolific perpetrators were The Gentlemen and Qilin, each claiming 15 attacks. LockBit claimed nine, while Interlock and Nova each claimed six. These groups are not picky — they are opportunistic, and universities often present a soft target.
Ransom Demands Are Getting Bigger
It’s not just the number of attacks that’s climbing. The price tag is, too. The median ransom demand for education-sector victims hit $420,620 in H1 2026 — a 53% jump from the $275,000 median recorded in the second half of 2025.
The single largest demand came after an attack on Mount Royal University in Canada. Hackers demanded $1.9 million. A month after the breach, the university’s systems were still crippled. The attackers claimed to have stolen over 10 terabytes of data. But the theft wasn’t the worst part.
“The hackers also deleted entire drives of data, which hasn’t just impeded the college’s ability to recover from the attack but means some data may be completely unrecoverable, too,” Moody said.
That’s a nightmare scenario for any institution. Student records, research data, financial systems — all potentially gone for good. The incident underscores a harsh reality: ransomware isn’t just about encryption anymore. Data destruction is becoming a weapon.
Why Universities Are Such Juicy Targets
Universities operate like small cities. They have sprawling networks, thousands of users, and a culture of openness that clashes with strict cybersecurity. Protecting sensitive student data is a challenge when labs, libraries, and lecture halls all need access. Budgets for IT security often lag behind those in the private sector.
Ransomware groups know this. They also know that universities cannot afford prolonged downtime. A week of locked systems means canceled exams, disrupted research, and reputational damage that lasts years. That pressure makes administrators more likely to pay.
The rise of The Gentlemen shows how quickly a single group can reshape the threat landscape. In six months, they went from a footnote to a headline. If universities don’t adapt, the second half of 2026 could be even worse.
What Universities Can Do Right Now
There is no silver bullet, but experts recommend several concrete steps:
- Segment networks so that a breach in one department doesn’t cascade across the entire campus.
- Enforce multi-factor authentication for all staff, faculty, and students accessing sensitive systems.
- Back up data offline — and test those backups regularly. The Mount Royal case shows that online backups can be destroyed alongside primary data.
- Conduct regular phishing simulations because many ransomware attacks start with a single compromised credential.
- Develop an incident response plan that includes communication protocols, legal obligations, and ransomware negotiation guidelines.
The threat is real, and it’s accelerating. Universities that treat cybersecurity as an afterthought are inviting disaster. The Gentlemen and their ilk are not going away — they are just getting started.
