Schools in England recover faster from cyber attacks

If you work in a school, a cyber attack can sound distant until the moment email stops working, registers cannot be opened, or coursework suddenly feels at risk. That is why the latest findings from Ofqual matter. Across England, schools are getting better at recovering when incidents happen, but the wider picture is only partly reassuring. Ofqual's third annual survey, covering the 2025 to 2026 academic year, points to clear progress after a difficult period for schools. The message from the regulator is hopeful but firm: improvement is real, yet too many schools are still not as prepared as they should be.

According to Ofqual, 27% of schools experienced a cyber incident in 2025 to 2026. That is down from 29% in 2024 to 2025 and 34% in 2023 to 2024. When incidents did happen, 66% of schools said they were able to recover immediately, up from 55% a year earlier. Reports of critical damage also fell, reaching 7%. **What this means:** the trend is moving in the right direction, but lower numbers do not mean lower stakes. Even one serious incident can disrupt teaching, unsettle staff and leave pupils wondering whether important work has been lost.

That human side matters. Ofqual's Amanda Swann warned that a cyber breach can create real uncertainty for students, especially if marks or coursework disappear, and the effect on staff confidence can last even after systems are restored. The examples collected through the survey help bring those numbers into focus. One teacher described an IT team spotting and stopping attacks while they were happening. Another said staff training had helped colleagues recognise warning signs and avoid greater harm. But other schools faced much sharper disruption, including the loss of network and email access, and one incident serious enough for police to close the school, leaving pupils and staff anxious.

One of the most revealing findings is about responsibility. Asked for the first time who is mainly responsible for cyber security, 46% of responding teachers said the IT team, 40% said all staff, and only 9% pointed to senior leadership. That matters because Ofqual is making a wider point here. Cyber security is not simply a technical issue to hand over to a specialist room at the end of the corridor. In a school, it affects teaching, assessment, communication and trust. If leaders do not own the plan, staff are less likely to know what to do when something goes wrong.

There is some practical progress to build on. Ofqual says 55% of the secondary schools surveyed have already taken steps to protect themselves from cyber attacks. Those steps include having a cyber security policy, carrying out risk assessments, and setting up backup and recovery procedures. **What schools can take from this:** strong preparation is often quiet and unglamorous. Backups, rehearsed response plans and regular staff training may not feel urgent on a normal day, but they are exactly what make recovery quicker on a difficult one. Ofqual is urging senior leaders to review arrangements with their IT lead and make use of the Department for Education's cyber response plan template and Cyber Security Hub.

It is also worth pausing on how the survey was done. The teacher percentages are based on a sample of 3,775 secondary teachers in England. Where the figures refer to schools, there was one response per school from the most senior teacher, giving a sample representing up to 2,162 schools. Teacher Tapp ran the poll for Ofqual on 13 July 2026. For teachers, parents and students, the lesson is fairly straightforward. Schools are getting better at bouncing back, and that is welcome. But the more useful takeaway is this: cyber security works best when it is treated as a whole-school responsibility, led from the top and understood by everyone who keeps school life moving.