ICO warns students pose an ‘insider threat’ to schools as teens hack into their school system for ‘a bit of fun’

The Information Commission’s Office (ICO) in the UK has warned schools that their own students could pose a threat to cybersecurity as it identifies a “worrying pattern” in the culprits behind data breaches.

The ICO analyzed 215 personal data breach reports caused by insider attacks from the education sector between January 2022 and August 2024.

It found that more than half of all insider cyberattacks are caused by students and almost a third of these are caused by students guessing weak passwords or finding them written down on paper. Students were responsible for 97 percent of all attacks caused by stolen log in details.

The ICO says that of the 215 incidents it analyzed, 23 percent were caused by poor data protection practices such as devices being left unattended, or students being given access to staff devices.

Only five percent of incidents were caused by insiders using sophisticated techniques to bypass security and network controls.

The ICO highlighted the example of a school in which three Year 11 students were caught unlawfully accessing its information management system. The students said they had an interest in IT and cybersecurity and were looking to test their skills and knowledge, having downloaded tools from the internet to break passwords.

Another student was caught unlawfully accessing a school’s information management system by using a staff member’s login in an incident that was reported to the police, the ICO and Action Fraud.

“Whilst education settings are experiencing large numbers of cyber attacks, there is still growing evidence that ‘insider threat’ is poorly understood, largely unremedied, and can lead to future risk of harm and criminality,” warns Heather Toomey, Principal Cyber Specialist at the ICO. 

“What starts out as a dare, a challenge, a bit of fun in a school setting can ultimately lead to children taking part in damaging attacks on organizations or critical infrastructure. 

“It’s important that we understand the next generation’s interests and motivations in the online world to ensure children remain on the right side of the law and progress into rewarding careers in a sector in constant need of specialists.” 

The ICO advises schools to take steps to improve their cybersecurity and data protection practices and remove temptation from students.

The ETIH Innovation Awards 2026

The EdTech Innovation Hub Awards celebrate excellence in global education technology, with a particular focus on workforce development, AI integration, and innovative learning solutions across all stages of education.

Now open for entries, the ETIH Innovation Awards 2026 recognize the companies, platforms, and individuals driving transformation in the sector, from AI-driven assessment tools and personalized learning systems, to upskilling solutions and digital platforms that connect learners with real-world outcomes.

Submissions are open to organizations across the UK, the Americas, and internationally. Entries should highlight measurable impact, whether in K–12 classrooms, higher education institutions, or lifelong learning settings.

Winners will be announced on 14 January 2026 as part of an online showcase featuring expert commentary on emerging trends and standout innovation. All winners and finalists will also be featured in our first print magazine, to be distributed at BETT 2026.

To explore categories and submit your entry, visit the ETIH Innovation Awards hub.