Vice chancellors warned of increasing cyber threat

David Batho, our director of sector security, warned leaders in tertiary education and research that they face sustained cyber pressure. While ransomware and phishing remain the leading concerns in our cyber posture survey, the nature of cyber extortion is changing, supply chains are a source of vulnerability, and the sector’s security capacity is uneven.

In the first quarter of 2026, we reported eight ransomware attacks on member institutions and found over 144,000 username and password combinations relating to members on the dark web.

David warned that stolen data credentials or other data can be leveraged to extort organisations as criminal groups emerge supplying “ransomware as a service”. He emphasised that research data is particularly valuable as a source of intellectual property and the risk to research institutions’ reputations and partnerships in the event of theft.

David urged leaders to investigate the security of third-party service suppliers following high-profile incidents in the automotive and retail industries. He emphasised the importance of knowing exactly who can access systems, how quickly suppliers can notify them of incidents, and how to source data and logs. He recommended that incident recovery tests should be conducted together with suppliers.

Actions that senior leaders themselves can take immediately include assuring internal governance and security responsibilities.

Updates to the Cyber Essentials standards, the National Cyber Security Centre’s Cyber Assessment Framework, and the upcoming Cyber Security Resilience Bill place further responsibilities on charities and public bodies to implement and evidence cyber security controls. David acknowledged the challenge many further education colleges face in funding dedicated cyber security staff.

How we can help

Our members benefit from a baseline of security provided by the Janet Network including DDoS mitigation, Protective DNS and incident support.

• Build confidence with the training and exercises offered through our cyber security services
• Set priorities with a cyber security assessment
• Strengthen operations by joining our Security Operations Centre