When Hackers Close the Classroom: Cyberattacks Emerge as a Hidden Threat to Learning

When a university’s learning management system goes dark in the middle of a semester, the damage is rarely measured in gigabytes or breached credentials alone. It is measured in missed lectures, postponed exams, anxious students, and instructors suddenly stripped of the digital tools that hold their courses together. A new scoping review published in Discover Education argues that this is precisely how cybersecurity failures should be understood in higher education: not as technical incidents confined to server rooms, but as educational disruptions that ripple through teaching, engagement, and equity. The study, a critical scoping review and quantitative content analysis of 24 peer-reviewed and policy studies published between 2014 and 2025, positions cybersecurity resilience as an associated determinant of what the author calls digital learning resilience in higher education institutions across developing and emerging economies.

The numbers that emerge from the analysis are striking. Half of the reviewed studies — 50.0 percent — characterise cybersecurity incidents as producing high-magnitude pedagogical disruption, while only a single study classifies the impact as low. Teaching presence, one of the three pillars of the well-known Community of Inquiry framework for online learning, was the most frequently affected dimension, appearing in 62.5 percent of coded studies. By contrast, only 16.7 percent of studies explicitly examined differential equity impacts, and a mere 12.5 percent addressed cybersecurity risks tied to artificial intelligence and learning analytics, despite the rapid adoption of AI-enabled educational technologies. For the review’s author, Abdullah F. Alenezi of the Public Authority for Applied Education and Training in Kuwait, this imbalance is the field’s central blind spot, particularly given that many of the world’s most cybersecurity-vulnerable universities sit in low- and middle-income contexts.

The theoretical backbone of the review is the Community of Inquiry framework, originally proposed by Garrison, Anderson, and Archer, which conceptualises successful online learning as the interplay of teaching presence, social presence, and cognitive presence. Read through this lens, the cybersecurity incidents reported across the literature map neatly onto distinct forms of educational harm. Ransomware attacks and cloud-service outages interrupt course delivery and sever instructor–student interaction, eroding teaching presence. Data breaches and phishing campaigns undermine the trust that online learning communities depend upon, weakening social presence. Persistent technical instability fragments the sustained, collaborative inquiry that constitutes cognitive presence. The review is careful to note that these are associations reported across studies rather than demonstrated causal relationships, but the consistency of the pattern across 24 studies spanning 14 geographical contexts — from Morocco and Moldova to Indonesia, Ghana, Ecuador, and China — lends the synthesis considerable weight.

Student engagement theory adds a second interpretive layer. Drawing on Fredricks, Blumenfeld, and Paris’s multidimensional model of behavioural, emotional, and cognitive engagement, the review suggests that cybersecurity incidents are associated with reduced participation, diminished confidence in institutional digital systems, and interruptions to sustained learning activities. In practical terms, a student whose university suffers a data breach may become reluctant to submit work through institutional platforms, share ideas in online forums, or trust that assessments are secure. That psychological dimension, the review argues, is routinely missing from institutional risk assessments, which tend to count compromised endpoints and downtime hours rather than lost learning.

Why focus on developing and emerging economies? The review’s answer is structural. Higher education institutions in World Bank low-, lower-middle-, and upper-middle-income contexts frequently contend with resource constraints, legacy digital infrastructure, shortages of cybersecurity expertise, and widespread reliance on bring-your-own-device learning environments in which students connect through personal laptops and phones of wildly varying security quality. At the same time, these institutions are adopting cloud-based and AI-supported educational technologies at a rapid pace, often without equivalent investment in cybersecurity governance. UNESCO and OECD reports cited in the study highlight persistent inequalities in digital infrastructure and institutional capacity across these settings. The result, the review suggests, is a double burden: greater vulnerability to incidents, and slower, more painful recovery when incidents occur, with consequences that fall hardest on students who depend on shared devices, mobile connectivity, or limited institutional support.

The methodological machinery behind these conclusions is unusually rigorous for a scoping review. Following the Arksey and O’Malley framework as refined by Tricco and colleagues, and reported under PRISMA-ScR guidelines, the review searched Scopus, Web of Science, ERIC, and Google Scholar from January 2014 to March 2025, then ran an updated targeted search covering 2024–2025 to capture the fast-moving post-generative-AI literature. From 175 initial records, screening and backward reference-list searching yielded a final evidence base of 24 studies. Each was coded against a ten-variable framework covering primary threat type, pedagogical impact level, disrupted Community of Inquiry dimension, equity considerations, AI and analytics risk, mitigation strategy, study design, evidence quality, country income classification, and Sustainable Development Goal alignment. An independent second coder assessed a 25 percent subsample, achieving mean inter-rater agreement of Cohen’s kappa = 0.81 — a level conventionally regarded as substantial. Methodological quality was appraised using Critical Appraisal Skills Programme checklists, though, consistent with scoping review convention, quality ratings described rather than filtered the evidence.

The temporal analysis reveals a field that has not evolved in a straight line. The proportion of empirical studies was 40.0 percent in 2014–2019, fell to 28.6 percent during the pandemic-dominated 2020–2022 period, and rose to 58.3 percent in 2023–2025. Early work framed cybersecurity largely as a technical and governance challenge; the COVID-19 years shifted attention to keeping systems running during emergency remote teaching; and the most recent literature increasingly treats cybersecurity as a matter of educational resilience, learner engagement, digital equity, and AI governance. This non-monotonic trajectory, the review argues, reflects changing research priorities rather than steady accumulation of evidence — and it means the field still offers only a partial picture of how cybersecurity resilience actually shapes educational outcomes.

On the question of what works, the review delivers a sobering verdict. Technical governance frameworks such as ISO/IEC 27001 and the NIST Cybersecurity Framework are the most frequently recommended approaches, but their implementation is not consistently associated with lower reported pedagogical disruption in the coded evidence. Institutional theory offers one explanation: organisations may adopt such frameworks to satisfy regulatory or legitimacy expectations without embedding them in daily practice, especially where capacity is limited. By contrast, the strongest empirical evidence in the review — the only study to receive a High CASP rating — concerned contextual, simulation-based phishing training, which was associated with meaningful reductions in user susceptibility. Zero-trust architecture, one of the most promising emerging technical approaches, has been shown feasible in resource-constrained institutions through case-study evidence, but no reviewed study evaluated whether improved technical security actually translates into better pedagogical continuity or student engagement. The gap between what institutions deploy and what educators experience remains, in effect, unmeasured.

To organise these patterns, the review introduces the Cybersecurity–Pedagogy Resilience Framework, a five-dimension conceptual model grounded in Community of Inquiry theory, digital transformation theory, and institutional theory. Its dimensions — Technical Infrastructure, Pedagogical Integration, Human Capability, Governance and Policy, and Equity and Access — are operationalised through five testable propositions, labelled H1 through H5, linking cybersecurity maturity to measurable learning outcomes. The framework is explicitly presented as hypothesis-generating rather than validated: a diagnostic tool that universities can use for self-assessment, and a research agenda for future empirical work. An institution strong on technical infrastructure but weak on equity, for example, might prioritise bring-your-own-device security support and differential monitoring of learner disruption, while one with mature governance but weak human capability might invest in simulation-based cybersecurity education for staff and students.

The review’s broader message is a reframing. Cybersecurity, it argues, should be repositioned as a strategic educational responsibility, integrated within quality assurance, teaching, and learning governance rather than confined to information technology departments. Student digital safety belongs within student wellbeing and educational quality frameworks. And the field’s evidence gaps — longitudinal studies of infrastructure maturity and learning-platform continuity, mixed-methods work on security-by-design in digital pedagogy, experimental evaluations of training durability, comparative studies of governance integration, and equity-focused research on differential student impact — define a concrete agenda. With direct relevance to Sustainable Development Goal 4 on quality education and Goal 10 on reduced inequalities, the review makes the case that in an era when universities run on cloud platforms, learning analytics, and AI, the security of the digital classroom is inseparable from the quality of the education it delivers. Protecting that classroom, the evidence suggests, is no longer just an IT problem. It is an educational one.

Subject of Research: Cybersecurity resilience and digital learning continuity in higher education in developing and emerging economies

Article Title: Cybersecurity as a determinant of digital learning resilience in higher education a scoping review and content analysis of developing and emerging economies

Article References: Alenezi, A. F. (2026). Cybersecurity as a determinant of digital learning resilience in higher education a scoping review and content analysis of developing and emerging economies. Discover Education, 5(1), Article 1043. https://doi.org/10.1007/s44217-026-02217-y

Image Credits: AI Generated

DOI: 10.1007/s44217-026-02217-y

Keywords: cybersecurity, higher education, digital learning, educational equity, ransomware, Community of Inquiry, student engagement, developing economies, learning management systems, AI in education, scoping review, digital resilience