The bigger break is target selection. Ransomware crews are concentrating on weaker suppliers and a few heavy hitters because hitting a lab, pharmacy, telemedicine provider, or campus system can still shut down records, equipment, and services at the main institution.
Comparitech’s first-half 2026 data shows 104 ransomware incidents in global education, with 36 confirmed by victims. Higher education attacks rose 8% over the prior six months, but the broader education sector fell because primary and secondary school incidents dropped by a quarter; The Gentlemen drove much of the shift, with its education attacks up 275% and 80% of them aimed at colleges and universities.
That makes this a dependency problem, not just a victim problem. The same pattern that has hit EMEA healthcare supply chains is now showing up in universities, and concentrated actors can skew the sector picture even when the wider trend is flat or down.