The Information Commissioner's Office (ICO) has issued a warning about a growing 'insider threat' from students hacking their own school systems, following a rise in cyber attacks in the education sector.
An analysis of 215 personal data breach reports caused by insider attacks between January 2022 and 2024 found that 57 per cent were caused by students. Almost a third of these incidents involved students guessing weak passwords or using passwords written on paper, leading the ICO to say teen hackers 'are not breaking in, they are logging in'.
Heather Toomey, principal cyber specialist at the ICO, said what starts as 'a bit of fun' in school can lead to children taking part in damaging attacks on organisations or critical infrastructure. She stressed the need to understand young people's motivations to keep them on the right side of the law and guide them into cybersecurity careers.
Examples given by the ICO include three Year 11 students who accessed a secondary school's information management system holding data on over 1,400 students, using downloaded tools to break passwords. In another case, a student used a staff login to access a college system containing personal information of more than 9,000 individuals.
The watchdog found that only 5 per cent of incidents involved sophisticated techniques, while 23 per cent were due to poor data protection practices such as unattended devices or students using staff devices. The warning comes as government figures show 60 per cent of secondary schools and 44 per cent of primary schools have identified breaches or attacks.
