Why Hackers Love College Campuses and How Schools Can Fight Back

Services
Written By Cate Urban

Cybercrime in the U.S. in 2025:

3.9M records exposed
130 ransomware claims
3.5M University of Phoenix students impacted
100K Dartmouth students impacted
47K UPenn students impacted

They are our centers for learning, innovation and groundbreaking technology. They are some of the oldest institutions in the country. Now, they are under attack.

Increasingly, cybercriminals are targeting our colleges and universities. In 2025, nearly 3.9 million records were exposed in the U.S. alone. In fact, of the top five reported cyber incidents at universities globally, four of them happened at U.S. institutions. Additionally, the 3.9 million records exposed comprised 98 percent of the total exposed records globally.

Let’s take a look at some of the highest profile attacks and what we can do to counter them.

While the assault on universities is a global issue, the majority of the attacks are happening in the U.S. Out of the 251 global ransomware claims against education targets, 130 of these happened in the U.S.

To get an idea of the scope of the issue, let’s take a look at the top three cyber attacks in higher education in 2025 according to an analysis by Comparitech:

  • University of Phoenix: Nearly 3.5 million people affected after hackers found a hidden security flaw in Oracle’s E-Business Suite software, the software administrators use for finance and human resource management. The attack happened over a 3 month period before administrators discovered it.

  • Dartmouth College: Similar to the University of Phoenix attack, close to 100,000 people had their information stolen via a vulnerability in Oracle’s E-Business software.

  • University of Pennsylvania: Similar to the first two attacks, UPenn experienced a similar attack where hackers took advantage of a vulnerability in Oracle’s E-Business Suite software. Nearly 47,000 people were affected by the breach.

While these cases were high profile due to the nature of the attack, many and more U.S. educational systems face the same threat. Of the top 10 educational institutions hacked globally, 8 of them are U.S. institutions. 

The Canvas Attack

So far in this article we’ve covered attacks on Universities. But one incident deserves its own space simply due to the scale of the attack. We’re talking about the cyber attack on Canvas, the nation’s most widely used Learning Management System for colleges and universities. The system controls about 50 percent of all student enrollments. It’s safe to say that Canvas is a treasure trove of sensitive data. So, in May of 2026, when hackers breached Canvas, an understandable panic ensued among anxious students as the breach disrupted thousands of exams across North America, Australia and the United Kingdom.

What Happened?

On April 29th, Instructure, the maker of Canvas, noticed a cyber breach. The attack was later claimed by hackers who claimed to have stolen 3.5 terabytes of student and university data. The group threatened to publish this information before Instructure stepped in and agreed to pay the ransom.

According to Instructure, the attack happened when hackers exploited a vulnerability in support tickets within the “Free-For-Teacher” system.

Main Takeaways

One thing that is common across all these attacks is the ability of hackers to find and exploit a vulnerability in software to wreak havoc. Now more than ever, with the rise of AI and increased complexity of the cyber environment, it is crucial to shore up your cyber defensive capabilities to protect your student’s information.

The goal in any investigation is not to assign blame but to identify weaknesses and resolve them. Cybersecurity firms like WarCollar can help create a robust offense and defense against this rising threat.

  • Pen Testing: Pen testing (or penetration testing) is a simulated cyber attack on a computer system, application, or network. WarCollar can perform pen testing on your system to help find vulnerabilities before they are exploited by malicious hackers.

  • Compromise Assessments: Compromise assessments are when cyber security professionals do an assessment of your device or system to assess if there are any hackers currently in your system. WarCollar can perform compromise assessments to find hackers early and kick them out before they can carry out an attack.

  • Risk Assessments : Risk Assessments are a cybersecurity process to identify, evaluate, and then prioritize all threats and possible vulnerabilities to your system or device. WarCollar follows this process to effectively protect your system from the largest threats.

Let’s Get Started!

Cate Urban

I founded Urban Web Renovations after 11 years of leading global marketing strategies for nonprofit organizations in Washington, DC. In each position I held, one thing remained the same – my passion for managing web sites and social media accounts for both organizations and major thought leaders.

Next

Job Opening: Automated Test Engineer in Chantilly, VA