Schools hit by cyber attack and documents leaked
Highly confidential documents from 14 schools have been leaked online by hackers, the BBC can reveal. One of those was Pates Grammar School in Gloucestershire, targeted by a hacking group called Vice Society.
The documents, seen by the BBC, include children’s SEN information, child passport scans, staff pay scales and contract details, stolen in 2022. A spokesperson for Pates Grammar School said it took the security of its systems and data extremely seriously.
The Vice Society has been behind a high-profile string of attacks on schools across the UK and the USA in recent months. It allegedly stole 500 gigabytes of data from the entire Los Angeles Unified School District, according to technology website Wired.
The FBI in America has already released an alert on the group’s activities.
The documents stolen from Pates Grammar School were comprehensive, with hackers taking documents using generic search terms.
One folder marked “passports” contains passport scans for pupils and parents on school trips going back to 2011, whereas another marked “contract” contains contractual offers made to staff alongside teaching documents on muscle contractions.
Another folder marked “confidential” contains documents on the headmaster’s pay, and student bursary fund recipients.
Alongside information from Pates, the BBC found confidential documents purporting to be from the following establishments on Vice Society’s website.
Every school on this list has been contacted for comment.
Carmel College, St Helens
Durham Johnston Comprehensive School
Frances King School of English, London/Dublin
Gateway College, Hamilton, Leicester
Holy Family RC + CE College, Heywood
Lampton School, Hounslow, London
Lampton School issued a statement that read: “Teachers were aware of the breach but we did not inform them of the data that was stolen. The ICO did not tell us to notify the data subjects. We blocked remote access to all but a small number of staff with two-factor authentication, and all our passwords have been reset.”
Mossbourne Federation, London
Mossbourne Federation said: “Parents, pupils, staff and all concerned were immediately notified and kept up-to-date during the recovery process. We have fully recovered from the cyber-attack and have returned to normal operations.”
Pilton Community College, Barnstaple
Samuel Ryder Academy, St Albans
School of Oriental and African Studies, London
St Paul’s Catholic College, Sunbury-on-Thames
Test Valley School, Stockbridge
The De Montfort School, Evesham
The De Montfort School declined to comment.
The School of Oriental and African Studies confirmed it was hacked in September 2022, with staff contracts and budget details leaked among some 18,680 other files.
“We notified staff and students of the incident, and while we were able to prevent the incident escalating, it resulted in a small, limited data breach of files on internal storage.
“The individuals affected have been contacted, and we are continuing to offer support as required,” a spokesperson said. Hackers leaked the information on the dark web, a section of the internet often used by criminals.
The dark web is not indexed on regular search engines, and requires specialist browsing software to access it.
When data is stolen, Vice Society makes demands for money before leaking the documents if payment is not made.