Student protection and cyber security

The past year has seen a surge in cyber attacks across the UK, affecting organisations of every size and sector. From retail giants and financial institutions to local authorities and charities, no sector is immune to the evolving tactics of cybercriminals. Ransomware, phishing, and supply chain breaches have disrupted operations, exposed sensitive data, and caused significant financial and reputational harm.

The education sector has not been spared. Schools, colleges, and universities have faced targeted attacks, resulting in data leaks, service outages, and interruptions to teaching and learning. These incidents highlight the critical need for robust cyber resilience measures and clear response protocols. For education providers, the stakes are especially high. 

The Office for Students requires institutions to have comprehensive student protection plans in place setting out their assessment of risks to continuity of study, including the risk that a provider is no longer able to deliver one or more modes of study to students.  A plan that fails to take into account the diversity of its students and their needs may be non-compliant.  Providers should consider including the risk of a cyber incident, given the clear potential impact on all students, but particularly those studying at a distance, with additional support needs, or on particularly technology reliant courses.  In the event of a cyber attack, how will the provider ensure student data is safeguarded and continuity of education is maintained?

More broadly, Mills & Reeve’s Defensive Lines initiative serves as a powerful reminder of the scale of the threat and the serious impact cyber attacks can have on a range of organisations, as well as outlining steps that can be taken to mitigate risks.

To discuss matters further please get in touch with your usual Mills & Reeve contact or a member of our Cyber response team.