England's secondary schools reported a modest decline in cybersecurity incidents last academic year, with 27 percent experiencing an incident in 2025/26, down from 29 percent the previous year and 34 percent in 2023/24, according to a survey by exams regulator Ofqual.
The regulator surveyed 3,775 secondary teachers in England in July, counting one response per school for whole-school questions, a sample of up to 2,162 schools. Phishing was the most common incident, followed by data protection breaches, hacking and ransomware, which affected 2 percent of respondents. Staff data was the information most commonly compromised; student data was affected in 13 percent of incidents and student work in 1 percent.
Recovery improved more clearly. Among schools reporting an incident, 66 percent recovered immediately, up from 55 percent. A further 12 percent recovered within half a school term, while 2 percent took longer. The share of incidents causing what respondents considered critical damage fell from 10 to 7 percent, although Ofqual did not define the term and told The Register respondents could interpret it as they saw fit.
Ofqual could not explain the improvement, and staff understanding remains patchy. Fifty-four percent of teachers selected "I don't know" when asked what cybersecurity improvements their school had made, and around a third said they had received no cybersecurity training in the past year or were unsure, up from 28 percent a year earlier. Of those who did receive training, 65 percent said they made no changes as a result.
Teachers were divided over responsibility: 46 percent pointed to the IT team, 40 percent said it was shared among all staff, and just 9 percent identified senior leadership. Ofqual argued cybersecurity is a leadership responsibility rather than solely an IT problem.
Mat Pullen, director of education at Jamf, said the frequency and recovery figures were promising but the understanding of responsibility was a concern. "Reducing incidents matters, but so does recovering faster. Cyberattacks have closed schools for a week or longer in the past, further disrupting an education already hit by Covid and affecting the wider economy as parents take time off work. Ultimately, cybersecurity is a shared responsibility of IT, teachers and senior leadership, and breaking down these silos keeps technology secure and lessons running."
The findings look rosier than the government's Cyber Security Breaches Survey, published in April, which found that 49 percent of primary schools, 73 percent of secondary schools, 88 percent of further education colleges and 98 percent of higher education institutions had identified a breach or attempted attack. The figures are not directly comparable: Ofqual asked about "incidents," while the government survey counted identified attacks and breaches regardless of success and covered education institutions across the UK rather than secondary schools in England alone.