A secondary school in London has been the victim of a cyber attack that accessed a significant amount of personal data. Leytonstone School was temporarily closed as a result of the attack and the incident highlights that educational institutions remain a popular target for criminals.
Students are allowed to take exams at Leytonstone School but all other students are forced to work remotely after a cyber attack (Photo by Monkey Business Images/Shutterstock)
The 800 pupils at the school in Waltham Forest, north east London, will have to complete classes remotely until the school can reopen.
Cyber attack on Leytonstone School disrupts classes
Due to the attack, the school has been closed since last week’s semester break. Children have been forced to continue their classes from home, but students currently doing their GCSE have been allowed to take their exams on school grounds.
The attack led to access to a significant amount of personal data, reports the London Evening Standard. The school’s WiFi has also been taken offline and the phone systems are not working.
So far, no criminal gang has claimed responsibility for the attack.
The main reason the school cannot open is that a document called the “Single Central Record” is not accessible. This document contains information and reviews of all employees.
In a letter to the parents of the school’s students, Principal Jessica McQuaid stated that it was illegal to open the school without this document. Staff are in the process of re-creating the document, but the school is expected to remain closed for the remainder of the week.
McQuaid said in a letter to parents seen by the Evening Standard: “I am incredibly sorry for the short notice but it is illegal for schools to open without this document.” I am devastated that this IT incident took place and impacted the start of the term for the students.”
Content from our partners
The school has contacted the National Cyber Security Center and the data regulator Information Commissioner’s Office (ICO) to help them recover, advising parents to change their passwords on all school accounts, such as Google Classroom and ParentPay.
A spokesman for the ICO said: “Leytonstone School has reported an incident to us and we are investigating.”
Schools are popular targets for hackers
Schools are a common target for cybercriminals. Last August, ransomware gang Hive demanded £500,000 from two Bedfordshire secondary schools owned by the Wootton Academy Trust after they threatened to leak stolen data online during a cyberattack.
The cybercrime group did contact the students’ parents and warned that their children’s personal information would be released if the foundation didn’t pay.
In September last year, ransomware gang Vice Society claimed they had attacked a multi-academy trust that runs six schools with 4,500 students. The attack on the Scholar’s Education Trust left staff without access to internal systems, including emails and data from one of the schools, which ended up being illegally posted online.
Speaking to Tech Monitor in August, Brian Higgins, a security specialist at cybersecurity platform Comparitech, said the data stored by schools is a magnet for criminals because of its sensitivity. The consequences of a violation can be serious, he said.
“Unfortunately, there is a long list of things criminals can do with the information contained in these direct contact leaks.” [with the victims] to targeted phishing campaigns,” Higgins explained.
“Young people’s data is particularly popular with organized crime gangs to set up things like bank accounts because they are less likely to be discovered as victims likely haven’t already done so themselves.”
