Schools, universities and research institutions faced an average of 4,696 cyberattacks per organisation each week between January and July 2026, according to new Check Point Research data.
Education remains the world’s most targeted sector for cyberattacks, with threat levels increasing further as schools and universities prepared for the start of the new academic year, according to research from Check Point Research.
Between January and July 2026, education organisations faced an average of 4,696 cyberattacks per organisation each week, an 8% increase compared with the same period in 2025.
That was more than twice the global cross-industry average of 2,150 weekly attacks. Education ranked highest across all 23 industries monitored by Check Point, experiencing attack volumes around 70% higher than government, the second-most targeted sector.
The threat intensified during July, when education organisations experienced an average of 4,848 attacks each week, representing a 14% year-on-year increase.
Asia-Pacific recorded the highest attack volumes between January and July, averaging 7,452 weekly attacks per organisation. However, Europe and Latin America experienced particularly strong growth.
European education organisations were targeted by an average of 4,759 attacks per week, up 18% year-on-year, while Latin America recorded a 42% increase to 4,299.
Check Point warned that the education sector’s growing reliance on cloud services, online learning platforms and digital collaboration tools means successful attacks can have consequences extending beyond individual institutions to students, parents, research partners, government bodies and technology providers.
Researchers also found evidence that cybercriminals are creating infrastructure designed to exploit the back-to-school period.
Check Point identified 18,954 newly registered domains containing education-related terms such as school, university, college and student during July. This represented a 5% increase from June and a 3% rise compared with July 2025.
The proportion identified as malicious also increased. In June, one in every 305 newly registered education-related domains was classified as malicious by Check Point ThreatCloud. By July, the figure had risen to one in 226.
Researchers identified deceptive domains designed to resemble legitimate education and government services, as well as co-ordinated registration campaigns involving student loans and bootcamp students.
Phishing campaigns are another significant concern. Attackers are exploiting student rewards, discounts and enrolment processes to encourage victims to visit fraudulent websites and surrender personal or financial information.
In one example, researchers discovered a website impersonating a student rewards promotion from US retailer Target. Victims were offered a fake US$750 student reward before being redirected towards fraudulent offers and gambling-related content.
Separate malicious PDF campaigns impersonated schools and education institutions and redirected users through compromised websites to counterfeit Microsoft 365 and OneDrive login pages designed to capture credentials.
Check Point also discovered a malicious URL hosted on the compromised website of a school in Bangladesh. The page had displayed a fake Spotify-branded security verification CAPTCHA associated with attempts to distribute malware or evade security analysis.
The findings demonstrate how attackers can combine trusted brands, compromised legitimate websites and familiar education processes to make phishing attempts more convincing.
Check Point recommends that education institutions strengthen phishing awareness among staff and students, enable multi-factor authentication across email, Microsoft 365 and academic systems and regularly patch devices and platforms.
Schools and universities are also advised to monitor newly registered domains for impersonation attempts, review access permissions and strengthen protection around sensitive student, research and administrative information.
With cybercriminals increasingly aligning campaigns with the academic calendar, the research suggests cybersecurity will need to form a central part of preparations for each new academic year.