Kids hacking their own schools for fun, claims ICO

A new trend of schoolchildren hacking their own schools and colleges for fun or as a dare has prompted a new warning from the Information Commissioner’s Office (ICO).

The UK’s data watchdog revealed that students are responsible for the majority of “insider” cyber attacks in educational settings, and stated that many teachers and staff are failing to recognize the significant threat these pupils pose.

Since 2022, the ICO has investigated 215 cyber breaches originating from within educational institutions, finding that 57% were carried out by children. The motives range from curiosity to a challenge, but the consequences can be severe, involving illegal access to sensitive data.

In one instance, three Year 11 students used hacking tools downloaded from the internet to bypass security protocols and access school databases containing the personal information of over 1,400 students. When questioned, they claimed they were simply testing their cybersecurity skills.

Another case saw a student illegally log into a college database using a teacher’s details, and then proceed to change or delete personal information belonging to more than 9,000 staff, students, and applicants. The system stored highly sensitive data, including health and safeguarding records.

“What starts out as a dare, a challenge, a bit of fun in a school setting can ultimately lead to children taking part in damaging attacks on organisations or critical infrastructure,” said Heather Toomey, Principal Cyber Specialist at the ICO.

This issue is part of a growing trend of youth cybercrime. Teenage hackers have been implicated in a spate of high-profile attacks on major companies, including Marks and Spencer and Jaguar Land Rover.

The ICO highlighted one case where a seven-year-old was involved in a data breach and was subsequently referred to a program to educate them on the seriousness of their actions. With 44% of UK schools reporting a cyber attack in the past year, the threat from within is proving to be a serious challenge for the education sector.