Education cybersecurity · India
Education faced more attacks per organisation than any other sector in India in 2025. It also holds the data the law protects most carefully — children’s — and increasingly runs its classrooms, fees and examinations on platforms it does not control. This page covers the under-18 rule that arrives with the DPDP Act, how exam and learning platforms actually fail, and what a school, university or ed-tech company should fix first.
Reviewed 24 September 2026 · 13 sources cited
The short answer
Education cybersecurity in India now has a legal centre: from about 13 May 2027, the DPDP Rules require verifiable parental consent before processing the data of anyone under 18, and the exemption for educational institutions covers only tracking and behavioural monitoring for education or safety. Incidents go to CERT-In within six hours. Start with an inventory of student data and the platforms holding it, multi-factor login for staff, and independent testing of admission, exam and learning portals.
Why education
Check Point’s 2026 Cyber Security Report found education to be the most heavily targeted sector in India in 2025, at 7,684 attacks a week per organisation — ahead of government at 4,912. Campuses are open by design, staff and student accounts turn over every year, and much of the estate is web applications: admissions, fees, results, learning platforms. Verizon’s 2026 data for educational services found web applications to be the way malware got in for 71% of the malware cases it examined, and ransomware in 65% of malware breaches.
The pattern that matters most is concentration. In April and May 2026, attackers entered Instructure’s Canvas platform through its Free-for-Teacher accounts, twice, and in the second intrusion changed the pages some students and teachers saw when logged in; the platform, used by schools and universities worldwide, was taken offline into maintenance. PowerSchool’s intruder used an employee’s credentials on its customer-support portal to reach the school-records platform and exposed data on more than 60 million students and 10 million teachers; he was sentenced to four years in prison in October 2025. An institution can do everything right and still be breached through the platform it rents.
In India, the examination itself has become a target. In February 2026 a student reported to CERT-In that CBSE’s on-screen marking portal had a master password exposed in its public JavaScript, an OTP check that could be bypassed and a way to impersonate examiners — and, with them, to alter marks at scale. For the central recruitment and entrance examinations it covers, the Public Examinations (Prevention of Unfair Means) Act, 2024 already makes tampering with an examination’s computer systems an offence, and can fine a service provider up to ₹1 crore and bar it from exam work for four years.
From May 2027 the DPDP Act adds the strictest duty of all: the data of every student under eighteen needs verifiable parental consent, with penalties up to ₹200 crore for getting children’s data wrong. The sections below take the law first, then the attacks, then what to do.
Evidence
Indian attack volumes from Check Point, global breach patterns from Verizon’s educational-services analysis, and the two platform incidents. Each is linked in the sources.
Verizon’s figures describe educational-services breaches in its global dataset, not Indian ones. Check Point’s figure counts attack attempts, not successful breaches.
Real patterns
Each from a reported case in 2025–26. Two of the four were vendor platforms serving many institutions at once.
What we test: Authentication and authorisation on exam and marking portals, and what the browser is sent that it should never see.
What we test: Your own tenant’s configuration and integrations, and the questions to ask the vendor about tenant separation.
What we test: Which vendors hold your student data, how their staff reach it, and what your contract lets you require of them.
What we test: The site as search engines and visitors see it, the CMS and its plugins, and admin access.
What gets assumed
Each is common. Each is contradicted by the DPDP Rules, the Public Examinations Act or the incidents above.
What people assume“Schools are exempt from the DPDP rules on children.”
What is actually trueOnly partly, and narrowly. The Fourth Schedule exempts an educational institution from the parental-consent and no-tracking duties only where processing is restricted to tracking and behavioural monitoring for its educational activities, or for the safety of enrolled children. Admissions, fees, marketing and most other processing of a student under 18 need verifiable parental consent.
What people assume“Parental consent is a tick-box on the admission form.”
What is actually trueRule 10 asks for verifiable consent: the institution must use reliable details of the parent’s identity and age, which can come from an authorised entity such as a DigiLocker-based token. A box ticked by whoever filled in the form proves nothing about who that was.
What people assume“Our LMS vendor handles security.”
What is actually trueThe vendor runs the platform, but the institution decides why student data is processed — it is the Data Fiduciary, and remains responsible for what its processors do. The Canvas and PowerSchool breaches reached institutions that had done nothing wrong themselves; the contract and the evidence behind it were their only lever.
What people assume“Nobody attacks a school.”
What is actually trueEducation was the most-attacked sector in India in 2025 by Check Point’s count — 7,684 attacks a week per organisation. Most are automated and indiscriminate; they find whatever is exposed.
What people assume“The exam system is the exam body’s problem.”
What is actually trueFor the central examinations it covers, the Public Examinations Act makes tampering with a public examination’s computer network, resource or system an offence, and a service provider found responsible can be fined up to ₹1 crore and barred from exam work for four years. Vendors and technology partners engaged to run an examination are inside the law’s reach.
14-question self-check
Tick only what you could show someone today. Nothing you tick leaves this page.
Next step
A 30-minute call with a practitioner who understands both the DPDP children’s rules and the portals that carry them. No charge, and no obligation.
A plan you can run
Sequenced around the academic year, because that is when data, accounts and exposure change.
Where SemperWise fits
Services are people doing the work; SemperWise One is the platform that keeps the evidence current between engagements. Each row says which.
“Our admission, results and exam portals.”
Authenticated testing as students, parents, staff and examiners, looking for the access-control and exposed-secret flaws behind recent exam-platform disclosures.
Web application testing“Our app is mostly APIs.”
Object-level authorisation, token handling and separation between institutions and students, tested endpoint by endpoint.
API security testing“What does the DPDP Act mean for us?”
A fixed-scope readiness assessment: the data you hold, the under-18 population, what the exemption does and does not cover, and a plan dated to May 2027.
DPDP readiness“Consent and parents’ requests, at scale.”
In SemperWise One, per-person consent records, a public form for access and correction requests with the statutory clocks attached, and breach reports drafted against the 72-hour deadline.
DPDP operations“What do our platform vendors actually do?”
Vendor assessments scored against your requirements, with the evidence they send kept and dated in one register.
Vendor and questionnaire tooling“We have dozens of department sites.”
Continuous discovery of everything under your domains, so a forgotten site or a new hidden page is noticed quickly.
Attack surface management“Our WordPress department sites.”
Plugin, theme and hosting review for the sites most often hijacked for spam.
WordPress security“Staff and students keep clicking.”
Awareness sessions built for staff who handle student data, and short sessions students will actually sit through.
Security trainingQuestions
What buyers in this sector ask us before they commit to anything.
Yes. A school, college or university that holds students’ or staff members’ personal data digitally is a Data Fiduciary under the Digital Personal Data Protection Act, and the core duties apply from about 13 May 2027: notice, consent, reasonable security safeguards, breach notice and rights handling. For students under 18, verifiable parental consent is required, except within a narrow exemption for tracking and behavioural monitoring for educational activities or child safety. Government institutions are covered unless specifically notified otherwise. A DPDP readiness assessment sizes the work.
Rule 10 of the DPDP Rules, 2025 requires the institution to verify that the person consenting is the child’s parent and an identifiable adult, using reliable identity and age details already held or supplied through an authorised entity — a DigiLocker-based token is one example the Rules contemplate. In practice that means changing the admission flow, not adding a checkbox: capture who the parent is, verify them, record the consent, and make withdrawal as easy as giving it. SemperWise One keeps per-person consent records for exactly this.
Possibly not, and nobody should assume it is. The Fourth Schedule’s exemption applies to an educational institution, defined as an institution of learning that imparts education, and only where processing is restricted to tracking and behavioural monitoring for its educational activities or for the safety of enrolled children. A platform that is not itself imparting education, or that uses data for marketing or personalisation beyond that purpose, is on uncertain ground. This is exactly the kind of question to take to counsel before building for it.
Listed cyber incidents — including data breaches and leaks, website defacement, unauthorised access and malicious code such as ransomware — must be reported to CERT-In within six hours of noticing them, under the April 2022 CERT-In Directions, which reach both private institutions as body corporates and government ones. Keep logs for 180 days within India. From May 2027, a personal-data breach also triggers DPDP notice to the Data Protection Board and to affected students and parents without delay, with a detailed report within 72 hours.
Test them the way an insider would try to abuse them: logged in as candidates, examiners and administrators, checking that each role reaches only what it should, that one-time passwords cannot be skipped, and that nothing secret is sent to the browser. The CBSE marking-portal disclosure in 2026 combined all three weaknesses. Test before each exam cycle, not only at launch, and keep a published route for reporting flaws. For the central examinations covered by the Public Examinations Act, a service provider found responsible for a breach of an exam’s systems can be fined up to ₹1 crore and barred for four years.
Legally and practically, yes. Under the DPDP Act you are the Data Fiduciary for your students’ data and responsible for what your processors do with it; the institution, not the vendor, faces the students, the parents and the Board. What you control is the contract and the evidence: require security safeguards, breach notice within a fixed number of hours, and proof of testing — and ask how free or trial tiers are separated from your tenant, which is how Canvas was entered in 2026.
At least once a year for anything that faces students, parents or the public, and before each admissions and examination cycle for the portals that carry them — those are the moments data volume and attention peak. Test again after any significant change to a portal. Continuous penetration testing suits institutions whose portals change every term.
Thank them, acknowledge quickly, and fix it. The most serious exam-platform flaw of 2026 in India was reported by a student, and how an institution responds decides whether the next researcher reports to it or to the press. Publish a simple vulnerability-disclosure page saying where to report, what you will do and that good-faith reporting will not be punished. If the flaw exposed data, assess whether it is a reportable incident — the CERT-In clock is six hours.
Checked by our research desk on 24 September 2026. Regulations and figures move; where a number here matters to a decision, follow it to the source.
Next step
A 30-minute call, no charge. You leave knowing what the under-18 rule means for your institution or platform, which portals to test first, and what your vendors should be proving to you — with a written scope and fixed price if testing makes sense.
