H1 ransomware roundup_ education comparitech.com

Ransom Demands Jump 53%—But Delano Refused to Pay and Won

Higher-ed attacks rose 8% while K-12 fell 26%, the Gentlemen gang tripled its operations, and the UK saw a 225% surge—but Delano's refusal to pay a $1.2M LockBit demand offers a rare success.

Source material: comparitech.com

Ransomware Education Sector Data Breach Cybersecurity Extortion Regulation

Ransom demands on schools jumped 53% to $420,620

Scale: 104 attacks
Payout: $420,620

In the first half of 2026, the median ransom demand against education providers reached $420,620, a 53% jump from $275,000 in the last six months of 2025. That escalation came despite a 13% drop in total attacks, from 120 to 104. No confirmed payments were made, but five institutions publicly refused to meet the demands. The median is drawn from 36 confirmed attacks where a ransom figure was actually stated. The rise suggests attackers are aiming higher, betting that universities and well-funded districts can absorb bigger asks. High-profile demands like Mount Royal University's $1.9 million pushed the median upward. None of the five refusals resulted in an immediate public data dump, but the absence of a leak doesn't mean the data is safe.

PEAR lists Monmouth University on its data leak site. comparitech.com

The Gentlemen gang tripled its education attacks in six months

Group: The Gentlemen
Scale: 15 claims

The ransomware group The Gentlemen claimed 15 attacks on education in the first half of 2026, up 275% from four in the prior half-year. Twelve of those 15 claims—80%—targeted higher education institutions. The group's six confirmed attacks were the most of any gang, ahead of Interlock's four and Qilin's and LockBit's three each. Confirmed targets included Centro Universitário Filadélfia and Universidade Federal de Sergipe in Brazil, Kozminski University in Poland, Sasin School of Management in Thailand, CHS Villach in Austria, Vysoká škola finanční a správní in the Czech Republic, and an unnamed institution in Japan. The 275% increase in claims came as Qilin, the other top claimant, saw its education claims drop 38% from 24 to 15 in the same period.

CMD Organization lists Mount Royal University on its data leak site. comparitech.com

One Japanese education provider exposed 664,000 records in a single attack

Scale: 664,000 records
Place: Japan

An attack on CKC Network, Inc. and Gakusan Co., Ltd., a Japanese education provider, breached nearly 664,000 records in May 2026—the largest single breach in the half-year's education ransomware tally. Unknown hackers were behind it, and the figure represents people notified of the breach. That total dwarfs the next largest: Alamo Heights Independent School District in Texas, which notified 26,629 residents after a Qilin attack in March. For further comparison, Monmouth University in the US has confirmed more than 1,500 affected so far, and Campbell University's breach count is pending with at least 500. The Japan incident alone accounts for most of the roughly 693,000 records known to have been breached across all 36 confirmed education attacks. The breach, claimed by no known group, shows how a single target can dominate the half-year's totals.

K-12 attacks fell 26% while higher ed rose 8%—a strategic pivot

Scale: 26% drop, 8% rise

Ransomware attacks on K-12 schools dropped 26% from the prior half-year, while higher education attacks increased more than 8%. The overall education sector saw 13% fewer attacks, declining from 120 to 104, but the decline wasn't uniform. Universities hold expansive data—research archives, student and staff records, and in some cases hospital data. Kyushu University's hospital patients were among the 43 people affected in a May attack. Higher education also saw prolonged disruptions: Mount Royal University in Canada, hit in June, was still suffering system outages over a month later, with a confirmed data breach and a claim of 10 TB stolen. The numbers suggest that while K-12 districts may be hardening their defenses, colleges and universities are becoming the new frontline, with attackers seeking higher ransoms and richer datasets.

Mount Royal University's $1.9 million demand and a month of outage

Payout: $1.9M
Place: Canada

An attack on Mount Royal University in Canada, which began on June 17, 2026, was still causing system disruptions more than a month later. The ransomware group CMD Organization claimed responsibility and said it stole 10 TB of data, issuing a ransom demand of 30 bitcoins, or $1.9 million at the time. The university confirmed the data breach but did not disclose how many people were affected. The prolonged outage underscores how ransomware can cripple an institution beyond the initial encryption—systems remain down while forensic teams work, and data theft adds a separate layer of liability. The $1.9 million demand was the largest confirmed in the half-year, a figure that pushes the median upward and shows what attackers believe a university will pay to regain control.

Delano Public Schools refused a $1.2 million LockBit demand—and its sanctions worked

Group: LockBit
Payout: $1.2M
Place: US

In May 2026, classes were canceled for a day at Delano Public Schools in Minnesota after a ransomware attack. LockBit claimed the attack in June, demanding $1.2 million. The school district refused to pay, citing the fact that LockBit is a sanctioned organization under US regulations; paying would have been illegal. Delano also said it was confident no breach occurred because hackers were locked out of its systems early on. As a result, no public leak has been reported, and the district confirmed that no ransom was paid. The $1.2 million demand was nearly three times the median ransom of $420,620 across confirmed attacks. The attack still forced a day of canceled classes, even though the refusal was based on legal prohibition.

Belgian school hackers went after parents directly after a $115,000 demand was refused

Payout: $115,000
Place: Belgium

The Belgian institute was hit in early January 2026, and the initial demand was €100,000 (about $115,000). The school refused, and the hackers then went around it: they began contacting parents individually, demanding €50 per child. The per-family ask was a tiny fraction of the institutional ransom, but it multiplied across the student body and turned every parent into a negotiation party. The messages carried the name ‘Lock-Bit,’ but the evidence doesn’t tie the attack to the real LockBit group; the brand appears to have been borrowed to add weight to the threats. The institute was one of five confirmed education victims in H1 2026 that publicly stated it had not met the hackers’ demands. In practice, the attackers exchanged one large, likely unpayable demand for many small ones aimed at people with less leverage and more personal exposure. No payment by the school was confirmed, and the school’s refusal did not end the harassment—it just redirected it to students’ families.

US attacks fell 44% to 34, but the UK saw a 225% jump to 13

Scale: 34 attacks
Place: US, UK

The US recorded 34 attacks in H1 2026, down 44% from 61 in the prior half-year. The UK recorded 13, up 225% from 4. Brazil had 8, up 33%, and Thailand had 5, up 150%. The US still led confirmed attacks with 12, and those confirmations covered a mix of K-12 districts and community colleges. The UK’s rise is the sharper signal: a country that logged only 4 attacks in H2 2025 took 13 in H1 2026, making it the second-most-targeted country after the US. Brazil and Thailand also grew, but from smaller bases. The geographic spread may reflect shifting attacker priorities, but the data alone doesn’t name a cause. The US decline was not uniform across education levels: K-12 attacks fell 26% while higher education attacks rose 8%, and groups like The Gentlemen concentrated their claims on universities. That divergence matters because it suggests the US drop was carried by schools, not colleges.

Only 36 of recorded attacks were confirmed—the rest are unverified claims

Scale: 36 confirmed

Only 36 of the ransomware attacks logged on education in H1 2026 were confirmed by the targeted institutions; the other 68 rest on a gang’s word. A confirmation happens when an institution discloses a ransomware incident or acknowledges a cyber attack matching a claim. The absence of confirmation doesn’t mean the claim is false—the victim may choose silence, and many countries don’t require breach disclosure. In the US, state notification thresholds force some organizations to confirm, but that doesn’t hold elsewhere. Timing also muddies the count: groups often post claims weeks or more after the attack, so an incident claimed in January may be confirmed later as a December event and shifted to the earlier month. That is why a gang’s public list is a set of assertions, not a ledger. The confirmed total is the only part verified by a second party, and even it can grow as late disclosures come in.

No ransom payments confirmed, but data deletion remains unproven

Place: Australia

During H1 2026, no education institution confirmed paying a ransom. Five entities explicitly said they had not met the hackers' demands. The demands themselves were large: Delano Public Schools faced $1.2 million from LockBit, Lehigh Carbon Community College had a $100,000 demand from Medusa, and Onze-Lieve-Vrouw Instituut in Belgium received a €100,000 demand from a group claiming to be Lock-Bit. The Belgian institute refused, and the hackers then began contacting parents with a €50-per-child extortion. Mount Royal University’s attack, claimed by CMD Organization, continued to cause system disruptions more than a month later, and a data breach was confirmed, with the group claiming 10 TB stolen. The absence of a payment does not mean data is safe: attackers can still leak information or walk back an agreement. A victim’s stated refusal is only one step in a longer process, and the threat of exposure remains.

Where this came from. This breakdown is based on source material published at comparitech.com. Images above are used with the credits shown beneath each one.