Most School Hacks Carried Out by Pupils ‘For Fun’, Watchdog Warns
More than half of all cyber-attacks and data breaches in schools and colleges are being carried out not by outsiders, but by pupils themselves, the Information Commissioner’s Office (ICO) has revealed.
Children and young people are hacking into school systems for fun, dares, or curiosity, a trend the watchdog describes as a serious “insider threat” that many teachers fail to recognise.
Since 2022, the ICO has investigated 215 hacks in education, with 57% traced back to pupils. In nearly a third of cases, students guessed or stole teachers’ passwords to break into staff systems.
The incidents range from a seven-year-old caught in a data breach to teenagers using hacking tools to access personal records of thousands of staff and students.
In one case, three Year 11 pupils unlawfully accessed sensitive information belonging to more than 1,400 classmates. In another case, a college student used stolen teacher details to alter or delete data on more than 9,000 people, including addresses, health records, and safeguarding logs.
The ICO warns that what begins as a prank or test of skill can quickly escalate into damaging attacks. This growing youth cybercrime culture is not confined to schools.
Over the past year, teenagers have been arrested in both the UK and the US for major hacking campaigns targeting companies including MGM Grand Casinos, Transport for London, Marks & Spencer, Jaguar Land Rover, and the Co-op.
With 44% of schools reporting a cyber breach in the past year, the ICO is urging educators to recognise that threats often come from inside the classroom, not just from external hackers.
Children’s curiosity and digital talent should be nurtured, but not at the cost of privacy, safety, or the law. Every child has the right to be protected from exploitation and harm, and the right to privacy.
Schools and parents must guide children toward responsible pathways in cyber skills, ensuring their abilities are used to build, not break.
