Ransomware attack on 24 South Gloucestershire schools

More than 1,000 devices are having to be rebuilt and many teachers could start the new term today without laptops, whiteboards and other vital equipment and resources.

As reported, cyber criminals launched a “highly sophisticated” attack on Castle School Education Trust (CSET) on March 16, affecting not only its seven schools but 17 others maintained by the local authority who relied on the academy group’s IT infrastructure.

Live lessons have had to be cancelled and parents’ evenings postponed.

South Gloucestershire Council says 16 servers have now been rebuilt, back office systems are in place and services are being restored, giving every school “core functionality and access to management information”, with some schools affected worse than others.

Cllr Alison Evans, who is a parent, teacher and school governor, told South Gloucestershire Council cabinet on Monday, April 12, of the devastating impact.

She said: “I know from personal experience just how disruptive and distressing this attack has been as my husband is a teacher at one of the targeted schools.

“Years of topic lesson and intervention plans have been stolen.

“The last year’s remote learning including countless video lessons has been lost.

“Teachers have been unable to use the technology they’ve spent the last year fully integrating into their teaching.

“Online registers, payment assessments, coursework, children’s reports, teacher appraisals and more have been inaccessible for the last month.

“This added pressure and workload on top of the unprecedented demands of the last year has been immense for our educational professionals and the end still seems unsure.

“Some teachers are without their laptops to plan for the coming term and do not know if they will have their computers, whiteboards, printers or even photocopiers working when they return to school.

Cabinet member for education, skills and employment Cllr Erica Williams told the meeting: “I would like to congratulate our officers who were very swift to respond to this attack but also the digital team who have taken in devices to make them more secure.

“All departments involved are working as fast as they can to resolve this for the schools involved.”

Ransomware is malicious software digital extortionists use to block people from accessing their own data.

The cyber crooks encrypt a computer system’s files and add extensions to the attacked data, holding it “hostage” until the demanded ransom is paid.

A South Gloucestershire Council spokesperson said: “We understand that no ransom has been paid.

“From the information received from the police and CSET they believe that no personal data has been impacted.

“The attack was on the academy trust CSET and not the council but impacted some maintained schools that received their IT services through CSET.

“All local authority maintained schools that have been impacted have been supported by the council and we can confirm that 16 servers have been rebuilt, the back office systems are now in place and services are being restored.

“This gives every school core functionality and access to management information.

“Over 1,000 devices have been collected from schools and are being rebuilt and reimaged.

“The impact on each individual school has varied and depends on how they have structured their IT, so for some there has been little impact, for others it has been greater.

“The impact is greater for staff who may have developed resources that are kept in files, as resources that are kept in the Cloud will be unaffected.

“A lot of the resources that students use are web based and will not have been impacted by the attack.

“Schools have used additional devices that have not been impacted by the attack to support IT at both a staff and pupil level.”

The spokesperson said the council’s IT services department Integra Schools had taken on additional resources to support the schools.

“The most important initial step was to collect all the affected servers and devices to cleanse them all, then to work through the rebuild,” they said.

CSET academy schools are Downend Secondary, Marlwood Secondary, The Castle Secondary, Mangotsfield Secondary, Charfield Primary, Lyde Green Primary and Severn Beach Primary. All were impacted by the attack.

The local authority maintained schools affected are Blackhorse Primary, Bromley Heath Infants, Bromley Heath Juniors, Emersons Green Primary, Kings Forest Primary, Mangotsfield CE Primary, St Michael’s Winterbourne, Hambrook Primary, Samuel Whites Infant, Hanham Abbotts Junior, Frampton Cotterell Primary, Christchurch Infant School, Frenchay CE Primary, St Stephen’s Junior School, St Stephen’s Infant School, Staple Hill Primary and New Horizons Learning Centre.