Schools Face Rising Insider Cybersecurity Threats from Students

Insider threats have emerged as a significant concern for IT teams in educational institutions, particularly schools. A recent report by the UK’s Information Commissioner’s Office (ICO) highlights that students are increasingly responsible for personal data breaches within their schools, raising alarms about cybersecurity practices in these environments.

The report reveals that a staggering 57% of personal data breaches in schools were attributed to the students themselves. This alarming statistic underscores a critical issue in cybersecurity: the need for robust identity management and threat mitigation strategies. This year’s theme for Insider Threat Awareness Month, which concluded in 2025, was “Partnering for Progress,” emphasizing the essential connection between identity assurance and insider threat defense.

According to Pete Luban, the Field Chief Information Security Officer at AttackIQ, the motivations behind these breaches range from dares to rivalries, with students often seeking notoriety. Luban notes that the ease with which students access sensitive information stems from inadequate security measures in schools. He stated, “A large reason for the ease of access the students enjoyed was inadequate security measures and practices.”

The ICO report further indicates that nearly one-third of breaches occurred due to students guessing common passwords or discovering login details that were carelessly written down. This highlights a significant vulnerability in the current approach to cybersecurity within educational settings.

To address these challenges, Luban emphasizes the necessity for educational institutions to strengthen their cybersecurity protocols. He suggests implementing rigorous cyber hygiene practices, such as enhancing password complexity and restricting students’ access to sensitive information. “Proper cyber hygiene protocols would solve a large portion of the problems,” he explained.

For the incidents that involve more sophisticated technical skills, schools must evaluate their current cybersecurity frameworks. Luban advises that institutions should adopt proactive measures to close the security gaps exploited by students.

Moreover, it is crucial for schools to educate students about the ramifications of their actions in the digital realm. Luban stresses the importance of reinforcing data protection principles and individual data rights. By fostering an understanding of the potential consequences of cyberattacks, schools can not only mitigate risks but also decrease the likelihood of students falling victim to cyber malpractice.

The findings from the ICO serve as a wake-up call for educational institutions. As schools increasingly rely on digital platforms, they must prioritize cybersecurity to protect sensitive information. Failure to address these insider threats could lead to significant reputational damage and potential legal repercussions.

In conclusion, the rise of insider threats in schools necessitates immediate action from educational leaders. By implementing stronger security measures and fostering a culture of cybersecurity awareness, institutions can better safeguard their communities against the growing risk posed by student actions.