“If they do find a particular sector to be particularly profitable, they will hit this over and over and over again,” Mr. Callow said. Schools should take precautions, such as implementing multifactor authentication and promptly installing security updates, he said.

Last year, 1,043 schools in the United States were the victims of ransomware attacks, according to an analysis by Emsisoft. Of those, 26 were colleges or universities.

Henry Stoever, president and chief executive of the Association of Governing Boards of Universities and Colleges, said that technology “touches almost every part of the academic enterprise,” including financial and health information for students and faculty, and data on donors. Losing that data can be devastating, he added.

Austin Berglas, the global head of professional services at BlueVoyant, a New York City-based cyberdefense company, said that the average cost of a ransom attack aimed at a college or university is roughly $115,000, a low number compared to other sectors. Colonial Pipeline, the operator of a critical fuel pipeline on the East Coast, paid $5 million to recover data that was stolen in a ransomware attack last year.

The decision to pay depends on factors including whether the targeted institution caught and halted the breach in time, Mr. Berglas said.

A November 2020 attack on the Baltimore County Public Schools in Maryland forced the system to close for three days and erased data including grades and lesson plans. The cost of repairing the damage from the attack was nearing $10 million in November, according to the NPR affiliate WYPR. The district has not said what the demands were or whether the ransom had been paid.

Some victims, like the Broward County Public School District in Florida, the nation’s sixth largest, have publicly refused to pay. In March 2021, hackers demanded $40 million to keep them from releasing sensitive data, including financial contracts and Social Security numbers. A month later, cybercriminals posted about 26,000 files online, according to The South Florida Sun Sentinel.