Opinion
Cyber risk in higher education is typically synonymous with ransomware, business email compromise, data breaches, and operational disruption.
But emerging evidence from Australia and international markets suggests a broader challenge: the intersection of cybercrime, identity compromise, and financial fraud.
United Kingdom – The frequency of attacks
The UK demonstrates the intensity of the threat. According to the UK Government's 2025/2026 Cyber Security Breaches Survey, approximately 98% of higher education institutions experienced a cyber breach or attack in the preceding 12 months. Over one in four (27%) experience attacks weekly, with 79% reported impersonation attempts post breach, up from 68% the previous year.
This highlights the growing importance of protecting not only systems and data, but also institutional identities and trusted communications.
United States – The financial consequences
The FBI's 2025 Internet Crime Report recorded US$20.9 billion in reported internet crime losses, a 26% increase from 2024. Business Email Compromise and personal data breaches remain the largest categories for monetary loss. While these figures span the broader US economy rather than universities specifically, they illustrate the scale of the financial fraud environment in which universities operate.
Global higher education – The cost (and it’s increasing)
Sophos' State of Ransomware in Education 2026 reported that global higher education institutions affected by ransomware faced median ransom demands of US$775,200 (all- sector average US$698,000); median payments of US$515,000 (all-sector average US$769,000); and average recovery costs of US$2.26m excluding ransom payments (all- sector average $1.7m).
Sophos recorded education recovery costs increased from US$1.66m in 2025, with 26% of education providers needing up to three months to fully recover from the attack, nearly double the all-sector rate. This is material for institutions already managing significant financial and operational pressures.
Australia – The risk beyond the initial breach
Recent Australian university incidents demonstrate how cyber compromise can extend beyond operational disruption, with implications extending to students, employees, and the broader university ecosystem.
Universities are particularly exposed because of their combination of valuable identity information, complex payment arrangements, and extensive third-party partnerships.
The critical issue is that cyber incidents can create the conditions for subsequent identity theft, impersonation, and payment fraud. These risks may continue long after containment of the original incident, underestimating an institution's total exposure.
What does this mean for university leadership?
Effective mitigation increasingly requires an integrated approach that connects cyber intelligence, identity protection, fraud detection, payment verification, and incident response.
Should we manage cyber and fraud as interconnected risks? Are organisational structures, risk frameworks and controls still treating them as separate problems?
Where are you seeing the greatest opportunities to strengthen the connection between cyber security and fraud prevention? Which practical risk mitigation strategies are proving most effective?
The answers may help shape the next generation of university risk management.
Greg Denison is a senior banker with more than 25 years of experience working with Higher Education institutions. The views expressed are his own. Engagement on the topic is invited to: info@futurecampus.com.au / greg.denison@cba.com.au