As a leading B2B PR agency we like to practice what we preach. As such we regularly run our own online PR campaigns related to tech PR subjects that interest us, like cyber security. This campaign involved us submitting Freedom of Information requests to 134 universities in July 2020 to establish how many had been subject to ransomware attacks. Of the 105 universities that responded, 35 admitted to being attacked (33%), 25 said they hadn’t been (24%) and 43 refused to answer (45%).
With most universities reporting isolated incidents, Sheffield Hallam University and City, University of London stood out, reporting 42 attacks since 2013, and seven attacks since 2014, respectively. The following table contains the results in full. Please contact us if you’d like the data in a spreadsheet for further analysis.
| University/ Question | Has your university been subject to any ransomware attacks in the last ten years (definition of ransomware here)? | If so, when did they take place? | Have you paid a ransom/s in return for data stolen during aforementioned ransomware attack/s? | If you’ve paid ransom/s, then what’s the total amount you’ve paid? |
| Queen Margaret University | No | n/a | n/a | n/a |
| University of Leicester | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA |
| University of Essex | No | n/a | n/a | n/a |
| Royal College of Art | Does not hold info | Does not hold info | Does not hold info | Does not hold info |
| Glyndŵr University | No | n/a | n/a | n/a |
| Royal Academy of Music | No | n/a | n/a | n/a |
| Manchester Metropolitan University | No | No | No | No |
| De Montfort University | Yes | 2019 & 2016 | No, restored all affected data via our enterprise backup solution | n/a |
| University College London | Yes | 14th June 2017 | No ransom was paid. | n/a |
| University of Bedfordshire | no | n/a | no | n/a |
| Aberystwyth University | Yes | Cant confirm | no | n/a |
| University of Wolverhampton | No | n/a | n/a | n/a |
| UAL | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA |
| Oxford Brookes University | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA |
| University of Brighton | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA |
| The University of Edinburgh | No | No | No | No |
| University of Winchester | Yes | 2016 | No | n/a |
| University of London | Yes | January 2016 | No | n/a |
| University of Bradford | No | n/a | n/a | n/a |
| Barbican / Guildhall School of Music & Drama | No | n/a | n/a | n/a |
| London Business School | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA |
| Queen’s University Belfast | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA |
| University of Warwick | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA |
| Teesside University | No | n/a | n/a | n/a |
| Cranfield University | Yes | 2016 and 2017 | no | n/a |
| Queen Mary University of London | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA |
| London South Bank University | No | n/a | n/a | n/a |
| Heriot-Watt University | Yes | refused – 35(2)(g) – FOISA section | No | n/a |
| Liverpool John Moores University | Yes | 2017 | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA |
| University of Northampton | Yes | 2017 | No | n/a |
| University of Sussex | No | n/a | n/a | n/a |
| Leeds Beckett University | Yes | September 2016 February 2017 June 2017 | No | n/a |
| University of Strathclyde | refused – section 30(c) – (FOISA) | refused – section 30(c) – (FOISA) | refused – section 30(c) – (FOISA) | refused – section 30(c) – (FOISA) |
| University of Leeds | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA |
| Coventry University | No | n/a | n/a | n/a |
| Northumbria University | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA |
| University of Huddersfield | Yes | June 2018 and September 2018 | No | n/a |
| Nottingham Trent University | Yes | 2014 | No | n/a |
| St George’s University of London | No | n/a | n/a | n/a |
| University of Manchester | Yes | Not recorded | n/a | n/a |
| University of Bath | Yes | Not recorded | No | n/a |
| SOAS, University of London | No | n/a | n/a | n/a |
| University of Cumbria | Yes | October 2015 | No | n/a |
| Kingston University | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA |
| York St John University | refused – Section 43 (2) – FOIA | refused – Section 43 (2) – FOIA | refused – Section 43 (2) – FOIA | refused – Section 43 (2) – FOIA |
| Robert Gordon University | Yes | 2015 & 2016 | No | n/a |
| Buckinghamshire New University | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA |
| Sheffield Hallam University | Yes | 42 attacks since 2013 | No | n/a |
| University of Reading | Yes | refused – 31.1.a – FOIA | No | No |
| Harper Adams University | Yes | 2016 | No | n/a |
| The Royal Veterinary College | No | n/a | n/a | n/a |
| University of East Anglia | refused – 12 – FOIA | refused – 12 – FOIA | refused – 12 – FOIA | refused – 12 – FOIA |
| Durham University | refused – 12 – FOIA | refused – 12 – FOIA | refused – 12 – FOIA | refused – 12 – FOIA |
| Anglia Ruskin University | Yes | 2014-15 | No | n/a |
| Canterbury Christ Church University | No | n/a | n/a | n/a |
| University of Worcester | No | n/a | No | n/a |
| University of Hertfordshire | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA |
| Edinburgh Napier University | refused – 35(1)(a) – FOISA | refused – 35(1)(a) – FOISA | refused – 35(1)(a) – FOISA | refused – 35(1)(a) – FOISA |
| Bath Spa University | No | n/a | No | n/a |
| University of Oxford | refused – 31(3) – FOIA | refused – 31(3) – FOIA | refused – 31(3) – FOIA | refused – 31(3) – FOIA |
| City, University of London | Yes | 14th April 2014 23rd June 2015 26th June 2015 19th Feb 2016 16th June 2016 1st February 2017 16th February 2017 | No | n/a |
| University of Plymouth | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA |
| Liverpool Hope University | Yes | 2015 | No | n/a |
| The University of Sheffield | Yes | 2015 | No | n/a |
| Cardiff University | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA |
| Cardiff Metropolitan University | Yes | July 2016 | No | n/a |
| Glasgow Caledonian University | No | n/a | n/a | n/a |
| University of Chichester | Yes | 2015 | No | n/a |
| University of the West of England | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA |
| King’s College London | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA |
| Royal College of Music | Yes | March 2015 | No | n/a |
| Imperial College London | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA |
| University of Cambridge | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA |
| University of West London | Yes | Once in early 2017 and twice in early 2020 | No | n/a |
| Abertay University | No | n/a | n/a | n/a |
| Aston University | refused – section 43(2) – FOIA | refused – section 43(2) – FOIA | refused – section 43(2) – FOIA | refused – section 43(2) – FOIA |
| University of Glasgow | refused – 30 – FOISA | refused – 30 – FOISA | refused – 30 – FOISA | refused – 30 – FOISA |
| Swansea University | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA |
| University of Nottingham | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA |
| Goldsmiths, University of London | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA |
| Brunel University London | Yes | 2015 | No | n/a |
| University of Greenwich | No | n/a | n/a | n/a |
| Birmingham City University | Yes | n/a | No | n/a |
| University of York | refused – 36 (2c) – FOIA | refused – 36 (2c) – FOIA | refused – 36 (2c) – FOIA | refused – 36 (2c) – FOIA |
| University of St Andrews | refused – 18 – FOISA | refused – 18 – FOISA | refused – 18 – FOISA | refused – 18 – FOISA |
| Ulster University | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA |
| University of Liverpool | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA |
| University of Exeter | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA |
| University of Sunderland | Yes | 2017 | No | n/a |
| Bournemouth University | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA |
| Newcastle University | refused – 31(3) – FOIA | refused – 31(3) – FOIA | refused – 31(3) – FOIA | refused – 31(3) – FOIA |
| University of South Wales | No | n/a | n/a | n/a |
| Royal Holloway, University of London | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA |
| Lancaster University | Yes | 2013, 2015 | No | n/a |
| University of Surrey | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA |
| University of Derby | Yes | Feb 2016 | No | n/a |
| University of the West of Scotland | Yes | 25th January 2016 | No | n/a |
| University of Salford | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA |
| University of East London | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA |
| University of Portsmouth | No | n/a | n/a | n/a |
| University of Stirling | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA | refused – 31.1.a – FOIA |
| The Open University | Yes | January 9 2013 and January 1 2014 | No | n/a |
| University of Aberdeen | Information not held | n/a | No | n/a |
| University of Gloucestershire | Yes | 2015/16 | No | n/a |