Records stolen from Southville Primary School in Bristol; possible link to earlier Schools IT network attack
Records were exported from the management information system (MIS) of Southville Primary School in Bristol during a targeted cyberattack, according to Bristol City Council. The council has not disclosed what data was taken or how many students, parents or staff are affected. The school has notified affected parents and guardians and reported the breach to the Information Commissioner's Office (ICO). The council suspects the same criminals may be behind a separate attack on Bristol's Schools IT network, but this is unconfirmed. No suspects or cybercrime groups have been publicly identified.
Technical Details
- The earlier incident began with suspicious activity detected on September 21, followed by the discovery of malicious software on some school devices.
- On September 25, council officers disconnected internet access at 88 schools to contain the threat and stop lateral movement.
- The Southville breach is treated as a separate incident because its MIS is not hosted on the wider Schools IT network.
- The council found no evidence of large-scale data export from the wider Schools IT network.
- The initial access method is still under investigation, together with the full extent of the breach and any link between the two incidents.
- As of Wednesday evening, 84 of the 88 schools had limited internet access restored, including all 39 schools directly supported by the council's IT service. Security checks continue at the remaining schools.
Remediation
- The council is investigating with specialist cybersecurity experts and the Regional Organised Crime Unit.
- Affected parents and guardians have been contacted and the ICO has been notified.
- Schools are being reconnected in phases after security checks.
Linha do tempo
-
Records stolen from Southville Primary School in Bristol; possible link to earlier Schools IT network attack
ler a análise desta fonte ocultar
Records were exported from the management information system (MIS) of Southville Primary School in Bristol during a targeted cyberattack, according to Bristol City Council. The council has not disclosed what data was taken or how many students, parents or staff are affected. The school has notified affected parents and guardians and reported the breach to the Information Commissioner's Office (ICO). The council suspects the same criminals may be behind a separate attack on Bristol's Schools IT network, but this is unconfirmed. No suspects or cybercrime groups have been publicly identified.
Technical Details
- The earlier incident began with suspicious activity detected on September 21, followed by the discovery of malicious software on some school devices.
- On September 25, council officers disconnected internet access at 88 schools to contain the threat and stop lateral movement.
- The Southville breach is treated as a separate incident because its MIS is not hosted on the wider Schools IT network.
- The council found no evidence of large-scale data export from the wider Schools IT network.
- The initial access method is still under investigation, together with the full extent of the breach and any link between the two incidents.
- As of Wednesday evening, 84 of the 88 schools had limited internet access restored, including all 39 schools directly supported by the council's IT service. Security checks continue at the remaining schools.
Remediation
- The council is investigating with specialist cybersecurity experts and the Regional Organised Crime Unit.
- Affected parents and guardians have been contacted and the ICO has been notified.
- Schools are being reconnected in phases after security checks.