The extortion economy: ransomware groups against universities and public bodies

Ransomware began as a simple crime: encrypt a victim’s files, sell back the key. Today it is an economy, with groups that recruit affiliates, run leak sites, publish victim lists and negotiate like businesses. Universities and public bodies sit at the centre of it, because they hold sensitive data, run services people depend on and often have limited security budgets.

From encryption to extortion

CISA’s Ransomware 101 notes that ransomware actors often threaten to sell or leak exfiltrated data if the ransom is not paid. This is known as double extortion: steal the data first, then encrypt the systems, and demand payment for both the decryption key and silence. Good backups defeat the first threat (you can restore your files) but not the second (your data is already in someone else’s hands).

Some groups skip encryption entirely and extort on stolen data alone. ShinyHunters, which appears in two earlier lessons of this course, is an example: in the Canvas case, the leverage was the threat to leak student data by a deadline, together with defaced pages and an offline platform. The FBI’s May public service announcement, quoted by the Guardian, described the group as specialising in large-scale data breaches and extortion, and warned that such actors use “real or exaggerated claims” of access to prompt payment.

What the 2026 numbers say about education

Infosecurity Magazine reported on Comparitech’s education ransomware roundup for the first half of 2026. It counted 104 ransomware attacks on the education sector worldwide, 36 of them confirmed by the victim. Attacks on higher education rose 8% compared with the previous six months, even as attacks on primary and secondary schools fell by about a quarter. A newer operation, The Gentlemen, increased its attacks on education by 275%, with 80% of them aimed at colleges and universities.

The median ransom demand to education victims was $420,620, up 53% from $275,000 in the previous half-year. The largest demand, $1.9 million, followed an attack on Mount Royal University in Canada, where attackers claimed to have stolen more than 10TB of data. Comparitech’s Rebecca Moody noted that the attackers had also deleted entire drives, so some data might be unrecoverable.

Qilin and the public sector

The Record describes Qilin as one of the most destructive ransomware operations of 2025: it previously damaged dozens of hospitals and clinics in London, targeted several US municipalities, and launched significant attacks on the governments of Malaysia and Palau. The Record reported that Qilin claimed an attack on the US healthcare provider Covenant Health that exposed the data of 478,188 people, and that Comparitech tracked more than 700 Qilin attacks in 2025, 118 of them confirmed.

Why paying is a poor bet

• No enforcement: a deletion promise or “shred log” is the criminal’s word. Data may be kept, resold or used again.
• Funding the next attack: every payment finances the group’s tools, affiliates and future victims.
• Legal exposure: payments to sanctioned groups can break the law; take legal advice and involve law enforcement.
• It doesn’t restore trust: students, patients and staff still need to be notified and protected.

Whatever an organisation’s position on paying, it should decide in advance, with leadership, legal counsel and law enforcement contacts, not for the first time at 3 a.m. with a countdown on a leak site.

Defences that change the economics

The #StopRansomware Guide is a practical checklist. The measures that matter most for universities and public bodies:

• Offline, tested backups: keep copies attackers can’t reach, and practise restoring them.
• Data minimisation: data you delete on schedule can’t be used to extort you.
• Phishing-resistant multi-factor authentication, especially for remote access, email and administrator accounts.
• Fast patching of internet-facing systems and third-party platforms such as HR and learning systems.
• Network segmentation, so a compromised student lab can’t reach finance or research data.
• Watch for large or unusual outbound transfers: data theft has to leave the network before it can be leaked.
• An incident response plan with named contacts, including your national cyber agency and law enforcement.

On an individual Mac, FireAI contributes at the network layer, not as an antivirus: it shows which app is sending data where, can block an unknown app from reaching the internet, and offers a kill switch to cut the connection at once while you investigate.

Any testing of these defences, from phishing simulations to restore drills that touch production systems, should be done with written authorization from the organisation that owns the systems.