Schools Face Rising Insider Cybersecurity Risks from Students

Insider threats pose a significant challenge for information technology teams, as recent findings from the United Kingdom highlight a troubling trend. According to a report from the Information Commissioner’s Office (ICO), more than half of personal data breaches in schools are perpetrated by the students themselves. This alarming statistic brings to light the urgent need for educational institutions to enhance their cybersecurity measures.

The conclusion of Insider Threat Awareness Month for 2025 focused on the theme “Partnering for Progress,” which emphasizes a critical gap in enterprise security. Many cybersecurity professionals believe that understanding identity is essential for mitigating insider threats. Continuous identity assurance can help organizations detect misuse before it leads to a significant breach.

While the typical focus is on larger enterprises, schools might be emerging as serious contenders for insider threat incidents. The ICO’s report revealed that students are responsible for 57% of data breaches within these institutions. This finding raises questions about the security protocols currently in place.

According to Pete Luban, Field Chief Information Security Officer at AttackIQ, the motivations for these breaches often stem from social dynamics among students. He stated, “The ICO has revealed that over half of personal data breaches in schools were conducted by the students themselves. The report claims that dares, money, rivalries, and notoriety are among the most common reasons for carrying out the hacks.”

The report indicates that inadequate security measures significantly contribute to this issue. Nearly a third of the breaches occurred because students were able to guess common passwords or found their login details written down. Such lapses in basic cybersecurity practices leave sensitive information vulnerable.

In addressing these challenges, Luban suggests that educational institutions must take significant steps to improve their cybersecurity posture. “Proper cyber hygiene protocols, such as strengthening passwords and limiting student access to sensitive information, would resolve a large portion of the problems,” he advised.

For incidents requiring more advanced skills, schools need to assess their cyber defense systems and implement proactive measures aimed at closing existing gaps. “Additionally, students must be made aware of the consequences of carrying out these attacks,” Luban added. By reinforcing data protection principles and individual data rights, schools can educate students not only about the potential punishments for engaging in cyberattacks but also reduce the risk of them becoming victims of cyber malpractice.

As schools navigate this rising tide of insider threats, the need for robust cybersecurity practices has never been more pressing. With a significant percentage of breaches originating from within, institutions must prioritize the protection of sensitive data to safeguard both their operations and their students’ information.