Cybercriminals have launched what has been described as a “highly sophisticated” attack on Castle School Education Academy Trust in Bristol– and they’re not alone.  

Back in March, Castle School Education Trust (CSET) was hit by a ransomware attack, affecting not only the Trust’s seven schools, but 17 others in the local authority who relied on the same IT infrastructure. The ransomware attack caused a huge amount of disruption, with lessons having to be cancelled, and the parents’ evening postponed. As reported in the Bristol Post, South Gloucestershire Council have confirmed that 16 servers have been rebuilt, and services are being restored, but while every school has “core functionality”, some were more affected by the attack than others.

Ransomware is malicious software that encrypts data, before demanding a ransom in return for the decryption key; in some cases, those responsible threaten to leak sensitive or personal data, too. South Gloucestershire Council understand that no personal data belonging to pupils or parents has been compromised. Additionally, no ransom has been paid so far, with data being restored from backups.

It is currently unknown who was behind the ransomware attack on Castle School Education Trust. However, they aren’t the only school trust to have been targeted by ransomware this year. Around the same time as the attack in Bristol, all 17 schools in Cambridge Meridian Academies Trust (CMAT) were affected by a ransomware attack, which disrupted schools’ communications and caused major disruptions to lessons. In the case of Ely College, Covid testing was suspended for 24 hours while the school’s systems were down. Earlier in March, Nova Education Trust in Nottingham shut down its IT systems in response to a ransomware attack, which disrupted online learning for a short time.

The National Cyber Security Centre (NCSC) have stressed that there is no evidence to suggest that the ransomware attacks were co-ordinated by the same actor, but the centre have warned schools and other educational settings to take extra precautions in response to the spate of attacks.