An attack on a shared local authority school network in Bristol has affected 88 schools. In a second, targeted attack, criminals exported records from one primary school’s MIS.
Suspicious activity was spotted on 21 September, but the network wasn’t shut down until the 25th. Disconnecting schools then disrupted teaching, registration, printing and contact with parents.
Why it matters
On a shared network, whether that’s a local authority service, a trust WAN or a managed provider, your exposure isn’t limited to your own equipment. And containment itself closed schools. Both are decisions far better made before the day you need them.
Five things worth doing this month
- Map what’s shared and who can reach your systems across it.
- Ask who would call you in an incident, how quickly, and out of hours.
- Protect the MIS: review who can run bulk exports, enforce MFA, and turn on export auditing.
- Agree in advance who can authorise pulling the plug, and what teaching looks like without the network.
- Keep a paper fallback for registration, emergency contacts and your incident contact list.
Quick win: who can export your MIS data?
Pupil data rarely leaves a school one record at a time. It leaves as a report or an export. Check which MIS accounts can run bulk exports across the whole school. Most schools find the list is longer than expected: old staff roles, a supplier account, a generic admin login. Trim it, and make sure what’s left has MFA.
Bonus check: ask your MIS supplier how to see every export run in the last month. If no log exists, that’s worth knowing now rather than later.
How we can help
This story first appeared in School IT Intelligence Week 8, our free weekly briefing for school IT teams and leaders. Read the full issue or subscribe free to get it every week.
Not sure where your school stands? Give us one day in your school and we’ll review your systems, licensing and security, and show you where money is being wasted and where risk is hiding. Book your IT review day →