Cyber security in education: is your school’s data secure? 

Cyber security in education has moved from an IT concern to a leadership responsibility, and recent headlines have made that shift hard to ignore. A run of high-profile incidents across the sector has left one message clear: no school or trust is too small, or too well-run, to be a target.

The government’s latest Cyber Security Breaches Survey 2025/2026, published by the Department for Science, Innovation and Technology in April 2026, found that 73% of UK secondary schools had experienced a cyber security breach or attack in the past 12 months. Almost half of primary schools, 49%, reported the same. One in five secondary schools face attacks at least weekly, and 11% face them daily. The Department for Education’s Cyber Security Hub places education among the UK’s three most targeted sectors during 2024–25.

73% of UK secondary schools had experienced a cyber security breach or attack in the past 12 months

That secondary school figure has jumped from 60% a year earlier – a rise of 13 percentage in twelve months. School and trust leaders now own cyber security alongside safeguarding and reputation – it’s not a task that lives entirely with IT. A jump like that suggests the problem isn’t levelling off.

Why most data breaches in education start with people, not technology

Most breaches don’t start with a sophisticated attack on a firewall – they start with a clicked link, a shared password, an account that should have been closed months ago, or a supplier nobody checked properly. Technology matters, but the gaps that let attackers in are usually procedural: unclear ownership, outdated training, or an incident response plan nobody’s tested.

Procedural gaps are the ones school leaders can close without a bigger IT budget though. The question worth asking isn’t just ‘do we have the right software?’ It’s ‘would we know what to do if something went wrong tomorrow, and are we confident the people and processes around our systems would hold up?’

Five ways to strengthen cyber security in your school or trust

Start with governance

Leaders need visibility of the threats facing their school or trust, and confidence that the controls in place are actually working, not just written down somewhere. Ask when your policies were last reviewed, and who’s accountable if something goes wrong.

Invest in staff awareness

Regular training helps staff recognise phishing attempts, spot suspicious activity, handle sensitive information correctly, and know how to report a concern quickly. A policy nobody’s read isn’t protecting anyone.

Review access controls

Every user should have access only to the information their role needs. Strong password policies, multi-factor authentication, and prompt removal of leavers’ accounts all reduce the number of doors an attacker can try.

Assess third-party risk

Every software provider your school works with forms part of your attack surface, and procurement decisions carry more weight than they used to. Do your suppliers process personal data? Are data processing agreements in place? Can contracts be reviewed easily, or are they filed away and forgotten until renewal? Have suppliers demonstrated appropriate security controls, with obligations clearly documented rather than assumed?

Build incident readiness

No school can eliminate cyber risk completely. What separates a manageable incident from a damaging one is how fast and how well you respond, and whether you know exactly where your data lives before something goes wrong.

A quick cyber security health check

How many of these could your school or trust say confidently, right now?

• We provide regular cyber security training.

• We review access permissions on a set schedule.

• We review supplier contracts and their security obligations.

If you paused on any of these, you’re not alone. Most schools are working through the same list, and it’s worth revisiting now, rather than after an incident forces the issue.

Making cyber security part of everyday practice

Cyber security isn’t a one-off project. Cyber threats change, and the way schools handle data, staff, and suppliers changes with them. The schools that stay ahead treat this as ongoing practice: continuous training, regularly reviewed policies, and supplier contracts that get checked properly rather than filed away.

For MATs managing this across several schools, that consistency is the hardest part to maintain. Every HR by IRIS’s Training and CPD module keeps staff training current, including phishing and suspicious activity awareness, so trusts aren’t relying on a one-off induction session to cover something that needs regular reinforcement. Our Policies and Documents module gives trusts one central place to store, review, and confirm sign-off on the policies that matter across every school in the trust, from GDPR and data protection to IT and acceptable use, so leaders know staff have actually read and understood them, not just filed away and forgotten.

Every Compliance by IRIS’s Risk Management module supports the governance side directly: real-time visibility of risk trends across the organisation, with the ability to put actions and controls in place proactively rather than reactively. For leaders juggling supplier reviews, policy audits, and staff training across multiple sites, having that visibility in one place removes a lot of the guesswork about where the next gap might be.

What to do next

A data breach costs more than the immediate disruption to sort out. It costs the trust that parents, staff, and governors place in your school, and that kind of trust is hard to rebuild once it’s gone. Getting ahead of that starts with an honest look at where you stand today, not a perfect score, just a clear picture of the gaps worth closing first.

Not sure where the gaps are?

Our free cyber security quiz walks you through governance, staff training, access controls, and supplier risk, so you can see exactly where your school or trust stands today and what to prioritise next.

Take the quiz now to assess your current position.

Take the quiz

Or get in touch with our team to talk through how Every HR by IRIS and Every Compliance by IRIS can support a more secure school environment.