British school forced to close after cyber attack

A British school had to close after a serious cyberattack, after which a critical incident was declared.

Billericay School in Essex informed parents in a letter that its school grounds will be closed to all pupils on Monday 3 June.

Headmaster P. Berry said the attack resulted in the school’s entire IT system being compromised and rendered inaccessible by complex encryption.

“While our IT support staff are working hard to resolve the issue and have already made significant progress in restoring the necessary systems, the current situation is significantly impacting our ability to operate the school safely and effectively,” he explained.

The incident occurred despite the installation of industry-standard firewalls, firmware and malware protection, Mr Berry added.

The closure on June 3 will give teaching staff time to make alternative lesson preparations without having to access resources stored in the school system.

For students in Years 11, 12 and 13, all public exams and revision courses will take place as usual. All other classes are expected to return to normal on Tuesday 4 June.

Students in grades 7 to 9 have been told to use distance learning platforms in the meantime.

Students who are eligible for free school meals can collect a packed lunch from the school’s main reception between 11.30am and 1.30pm on 3 June.

Mr Berry wrote: “While I recognise the additional burden this is placing on families, we must ensure the school can continue to operate safely and effectively following this serious incident. I will write to you again next week to update you on the incident.”

Schools are a common target of ransomware

Billericay School has not provided further details about the nature of the attack or whether any data was stolen, but the letter suggests the incident was related to ransomware, with the institution’s IT systems rendered inaccessible by complex encryption.

In recent years, several UK schools have suffered data breaches as a result of ransomware attacks, in which hackers published stolen data online when their payment demands were not met.

In January 2023, threat actor Vice Society leaked confidential data online, including special educational needs (SEN) information, scans of student passports, staff pay scales, and contract details from 14 schools.

Several UK schools announced that they had fallen victim to ransomware attacks in September 2023, just before the start of the new school year. In some cases, this led to a delay in the start of school.