Almost two-thirds of British universities that responded to a Freedom of Information (FOI) request earlier this summer admitted to suffering at least one ransomware attack in the past year, according to SentinelOne. That’s not particularly surprising given the widespread use of this vector in cybercrime.

Ransomware Runs Rampant

What is interesting is how prevalent these attacks have been throughout academia: Many of the institutions suffered multiple such attacks in the last 12 months. One campus in particular — Bournemouth University — suffered 21 attacks over the year. Only 7 percent of the institutions said they haven’t ever been attack victims.

Attackers demanded ransoms ranging from $100 to more than $3,000. Not one institution admitted to paying up; many universities restored the encrypted data from backups. However, in general, overseas victims of ransomware are more likely to pay attackers to return their stolen data. This is because overseas attacks tend to hit higher-level staff members with sufficient clout to authorize the payments.

Another reason for the rise in ransoms has to do with the potential reputation harm. Universities are often competing for top candidates, high-profile faculty and staff, and endowment funds — the last thing they need is news of a successful cyberattack dragging their name through the mud.

A Global Problem for Academia

Sadly, the situation in Britain mirrors what other educational institutions around the world are also experiencing. Earlier this summer, according to Fortune, the University of Calgary paid attackers $16,000 to unlock a batch of stolen emails. The stolen information reportedly included vital data for academic research that hadn’t been backed up.

Academia is a rich target for cybercriminals. “Email addresses for staff are often in the public domain, which means that potentially the entire staff could be targeted at once, increasing the chance for successful infections,” Gianluca Stinghini, an assistant computer science professor at University College London, told SentinelOne.

Ramping Up Ransomware Protection

Academics are seldom early adopters of security technology. They are typically more open to promoting information sharing, which can make them vulnerable to malware that can easily spread across enterprise networks.

Several universities that were polled refused to answer the FOI requests, but the numbers revealed speak for themselves. Clearly, the time has come for universities to step up their game when it comes to protecting against ransomware.