Of these, nearly half (47%) faced unplanned expenses because of the attacks, including compliances fines, changes in leadership and lawsuits, according to the report from Netwrix, a cybersecurity provider.

The most common attacks in the last 12 months were phishing, user account compromise and ransomware or other malware attacks, according to the report.

The organisation surveyed 1,309 IT and security professionals within education institutions around the world. Dirk Schrader, VP of security research at Netwrix, said: “An incident can reveal security gaps such as excessive admin privileges, dormant accounts, weak or unchanged passwords, default passwords or configurations, and unpatched systems due to negligence or lack of knowledge.

“Fixing a gap might not immediately require spending additional money but will require time from the IT security team. In other words, addressing the root cause of a security incident results in additional investment, in either money or effort, or both.”

Fixing a gap might not immediately require spending additional money but will require time from the IT security team

Dirk Schrader, Netwrix

The report highlighted that 81% of educational institutions have hybrid IT models, compared to 74% across other industries. Of these, 47% plan to adopt cloud technologies moving forward.

Half of the educational institutions (51%) named lack of budget as the biggest data security challenge, slightly higher than in other industries.