19,300,000 + cyberattacks put UK education on alert
Proofpoint warns of university account takeover campaigns linked to job scams
CISO news
19,300,000 + cyberattacks put UK education on alert
K schools, colleges and universities are being subjected to a surge of automated cyberattacks, with SonicWall threat
U intelligence recording more than 19.3 million medium and high-severity intrusion attempts so far this year.
The total has already surpassed the 11.5 million events recorded across the whole of 2025, with SonicWall data showing a 67 % annualised increase in intrusion activity across UK education.
According to the data, the majority of activity was concentrated in SonicWall’ s Educational Services category, which accounted for 16.8 million events or 87 % of the sector total.
Attackers are primarily probing web-facing education infrastructure. Path traversal and directory manipulation attacks generated 10.2 million hits across the four leading signatures, while web-based attacks accounted for 17.3 million events overall.
Despite the surge in intrusion activity, ransomware remains comparatively rare. Just 36 ransomware events were detected across SonicWall’ s UK education sensor fleet, the lowest level recorded across any UK sector tracked.
“ Education is showing us that cyber-risk shows more than a ransomware gang breaking through the front door,” said Spencer Starkey, Executive Vice President, EMEA, SonicWall.“ We’ re seeing relentless automated scanning of the systems schools and universities depend on every day, from student portals to learning platforms, as attackers look for something that has been left exposed.”
SonicWall’ s analysis is based on Intrusion Prevention System( IPS) data from UK-registered education sensors in 2026.
Proofpoint warns of university account takeover campaigns linked to job scams
C ybercriminals are compromising US university email accounts and using them to distribute job-related advance fee fraud, according to research from Proofpoint.
Students can be particularly attractive targets because of financial pressures and their potential trust in communications originating from institutional email accounts.
The company’ s researchers are tracking a cluster of activity attributed to West African fraud actors that combines credential phishing, account takeover and subsequent financial fraud.
Attacks typically begin with emails asking recipients to verify or refresh their passwords, sometimes warning that accounts could be deactivated because of retirement, graduation or transfer.
Proofpoint said university accounts also provide attackers with credibility when targeting people both inside and outside an institution.
The findings demonstrate how an initial credential theft campaign can develop into further attacks by exploiting the reputation and contacts associated with a compromised university identity.
Victims are directed to forms hosted on legitimate services including Google Forms, Wix, Jotform, Zoho Forms and Microsoft Office rather than conventional phishing websites.
The forms request information including usernames, passwords and personally identifiable information, which can then be used to compromise university accounts.
Attackers subsequently use trusted. edu accounts to distribute fraudulent job or internship opportunities. These ultimately lead to advance fee fraud, demonstrating what Proofpoint describes as multistage monetisation rather than isolated scam activity.
WWW. INTELLIGENTCISO. COM 9