A Student Record Outlives the Encryption Protecting It

TL;DR

• Attackers took roughly 607,000 records from England's Department for Education, and education is now the most attacked sector in India, accounting for close to a quarter of all detections.
• Education holds data with the longest confidentiality life of any sector: a record created for a ten-year-old stays sensitive for sixty years, which makes it the ideal target for harvest-now, decrypt-later attacks.
• Encryption will not stop an insider or a stolen password, but it is the only control that still works after every other one has failed, which is why quantum-safe cryptography belongs at the base of the stack.

Cyber-attackers obtained around 607,000 records in an attack on England's Department for Education, taking telephone numbers and email addresses tied to individuals and organisations. The department contained the incident quickly, referred itself to the Information Commissioner's Office, and said no bank details or other sensitive information were involved. As breaches go, this one was handled well.

The reason it matters is what sits behind it. In the same survey cycle, the UK government found that around a quarter of further education institutions reported a breach or attack at least weekly, and more than half of schools reported one in the past year. A department losing contact details is the visible edge of a sector under continuous pressure.

The Sector Attackers Now Target Most

The scale globally is no longer marginal. In April 2026, the group ShinyHunters breached the Canvas learning management system, and by the company's own disclosure the incident involved roughly 3.65 terabytes of data covering records tied to about 275 million individuals across some 9,000 educational organisations in more than 100 countries. One platform compromise, a quarter of a billion people.

Ransomware is following the money into the same sector. Comparitech recorded 104 ransomware attacks on education worldwide in the first half of 2026, with attacks on higher education up more than eight percent even as school attacks fell. The median ransom demand rose 53 percent to $420,620, and the largest single demand, $1.9 million, followed an attack on Mount Royal University in Canada where attackers claimed to have taken over 10 terabytes of data. Analysts attribute much of the higher-education surge to one group whose education attacks rose 275 percent in six months.

India: The Country's Most Attacked Sector

India's position is starker. Seqrite's India Cyber Threat Report 2026 found the education sector had become the most heavily targeted industry in the country, accounting for nearly 24 percent of all detections, drawn from more than 8 million monitored endpoints and 265.52 million detections, an average of 505 every minute.

The consequences are already downstream. Threat intelligence researchers reported in May 2026 that a dark web forum carried a database of more than 12 million records from an Indian school platform, alongside an earlier breach exposing 682,000 student records including payment details and exam centre bookings. That data is not being hoarded, it is being weaponised: verified names, parental details and exam bookings make phishing indistinguishable from a genuine institutional message. In February 2026, a Bengaluru engineering student's account was used to route close to seven crore rupees in two days as part of a mule network.

Why Education Data Is Different

Every sector suffers breaches. Education has one property that almost no other sector shares: the data does not expire.

A bank card can be reissued in a week. A password can be rotated in a minute. A student record cannot. It contains a name, a date of birth, a government identity number, parental details, addresses, health and special-education notes, and payment history, assembled when the person is a child and still identifying them sixty years later. Add research data, and a university may hold information that must stay confidential for the working life of a patent.

That is precisely the profile targeted by harvest now, decrypt later attacks, in which adversaries intercept and store encrypted data today to decrypt once quantum computers mature. For a payment processor, a decade-long delay makes the stolen data worthless. For a school, a decade-long delay is irrelevant, because the student is still twenty-two.

Education therefore carries the widest gap in cybersecurity between the value of the data held and the budget available to defend it. The sector holds records with a sixty-year sensitivity horizon on some of the thinnest security spending of any industry.

What Encryption Fixes, and What It Does Not

Being precise here matters more than being emphatic.

Most education breaches are not decryption failures. They are access failures. The United States Federal Trade Commission acted against an edtech provider after an intruder used the credentials of an employee who had left three years earlier to take records on 10.1 million students, and found the company had stored student data unencrypted for years despite warnings. In the Canvas case, attackers did not break the cryptography; they reached data that was already decrypted inside the application. No cryptography, quantum-safe or otherwise, defends against a valid login.

What strong cryptography does is decide what an attacker actually walks away with. Where records are encrypted at rest and in transit with quantum-resistant algorithms, exfiltrated archives stay unreadable rather than becoming a payout scheduled for the 2030s. Where keys are generated from true quantum entropy, predictable-randomness attacks close off. Where keys are centrally governed through a key management system, a single stolen credential unlocks one repository rather than every repository. And where the estate is built with crypto-agility, a sector with limited budget does not have to re-engineer its systems every time standards move.

So the honest formulation is this. Access controls, multi-factor authentication, vendor audits and data minimisation reduce how often a breach happens. Cryptography decides how much a breach costs when it happens anyway. Both are required, and education has historically underinvested in the second.

The Practical Order of Work

The sequence is not exotic. Find out where cryptography is used and where student data is actually stored, including every third-party platform holding it, through a cryptographic inventory. Prioritise by how long the data has to stay confidential, which in education means almost everything involving minors. Then migrate to standardised post-quantum cryptography in phases, beginning with archives and backups, because those are what get quietly exfiltrated and stored.

A department losing 607,000 contact records is recoverable. A national student archive read in 2035 is not.

Find out how long your data has to stay secret, and whether it will. Book a quantum readiness assessment and start with the records that cannot be reissued.