Loading story…
Higham Lane School in Nuneaton, England, was forced to close to all students and staff following a significant cyberattack that crippled its IT infrastructure. The attack rendered critical digital services, including telephones, email, and the school's management system, inoperable, prompting the administration to suspend in-person classes and issue a strict directive for students and staff not to log into any school systems, such as Google Classroom and SharePoint. The school engaged external cybersecurity specialists and a Cyber Incident Response Team from the Department for Education to investigate and contain the breach, while also notifying the Information Commissioner’s Office (ICO) as required by law.
The Central England Academy Trust, which oversees Higham Lane School, confirmed that incident response protocols were activated and that the full scope of the attack was still being assessed. While the nature of the incident and whether any data was exfiltrated remain unclear, the school administration emphasized the seriousness of the compromise and the need for maximum caution. The closure follows a broader trend of cyberattacks targeting the UK education sector, with over 80 ransomware incidents reported to the ICO in 2024, some of which also resulted in school closures and extortion attempts.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
As recovery work progressed, the school said reopening would be staggered through a phased return rather than an immediate full resumption of classes. This update reflected ongoing disruption even after the initial closure period.
The school coordinated with its local authority data protection officer and reported or prepared to report the incident to the Information Commissioner's Office to meet legal and safeguarding obligations. These notifications were made as the investigation into the cyber incident continued.
Following the attack, the school and Central England Academy Trust activated incident response measures, engaged independent cybersecurity specialists, and worked with the Department for Education's Cyber Incident Response Team and other IT experts to investigate and recover systems. Staff and students were instructed not to log into school systems during the response.
The disruption forced the school to close to students and staff and postpone reopening after the holiday break, with reports indicating at least two days of closure. Families were told the reopening date was uncertain while systems were being restored.
During the Christmas holiday period, Higham Lane School in Nuneaton suffered a significant cyberattack that knocked out core digital services, including telephones, email, servers, and the school management system. The type of attack and whether any data was exfiltrated were not confirmed in the reporting.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcego.theregister.com
Open sourcehighamlaneschool.co.uk
Open sourcetherecord.media
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A 16-year-old boy was arrested in Portadown, County Armagh, on suspicion of offenses under the Computer Misuse Act after a targeted cyberattack disrupted Northern Ireland’s centralized `C2K` school IT network. The Police Service of Northern Ireland said the suspect was later released while its cybercrime team continues investigating. The attack forced the Education Authority to take `C2K` offline to contain the incident, cutting off access to online teaching materials, assignments, exam revision resources, and communication tools used by most schools across the region. The Education Authority, working with service provider Capita and an incident response firm, said the breach affected a small number of schools and is believed to have compromised some personal data. Officials said the incident is currently assessed as contained, with no evidence of data corruption and recovery underway through password resets, added security measures, and phased restoration of services. Reconnection is being prioritized for pupils at critical academic stages, particularly those preparing for examinations, while authorities coordinate the investigation and any required notifications with the PSNI and the Information Commissioner’s Office.
Jun 29, 2026
Two 17-year-old boys were arrested in Bishop’s Stortford, Hertfordshire, in connection with a cyberattack and attempted extortion targeting the British nursery school chain Kido. The Metropolitan Police Service led the investigation after receiving a referral about a ransomware attack on September 25. The attackers gained unauthorized access to sensitive data, including pictures and names of children enrolled at Kido’s nursery schools, as well as addresses and contact details for their parents and carers. The perpetrators published images and personal information of 20 children online, out of an estimated 8,000 children affected by the breach. This exposure significantly increased the risk to the children’s safety and wellbeing, prompting widespread concern among parents, carers, and the cybersecurity community. The attackers used the stolen contact information to make threatening phone calls to parents and carers, escalating pressure on Kido to pay an extortion demand in bitcoin. The incident was described by cybersecurity experts as a disturbing evolution in criminal tactics, given the targeting of vulnerable children and the use of their personal data for extortion. The Metropolitan Police’s cybercrime unit worked swiftly to identify and apprehend the suspects, who remain in custody for questioning on suspicion of computer misuse and blackmail. The breach and subsequent extortion attempt have been condemned by both law enforcement and cybersecurity professionals, highlighting the emotional and psychological impact on the affected families. The authorities have reassured the public that they are taking the matter seriously and are providing support to those impacted. The case has raised broader concerns about the security of sensitive data held by educational institutions and the potential for such information to be weaponized by cybercriminals. The incident has also sparked discussions about the need for enhanced cybersecurity measures and awareness in the education sector. Law enforcement officials have emphasized the importance of reporting cyber incidents promptly to facilitate rapid response and investigation. The arrests represent a significant development in the ongoing investigation, but the full extent of the breach and its long-term consequences for the victims are still being assessed. The Kido nursery chain is cooperating with authorities and has taken steps to notify affected families and bolster its cybersecurity defenses. The case serves as a stark reminder of the evolving threat landscape and the need for vigilance in protecting sensitive information, especially when it concerns children.
Jun 29, 2026
A cybersecurity incident has disrupted the shared IT systems of the Royal Borough of Kensington and Chelsea, Westminster City Council, and the London Borough of Hammersmith and Fulham. The attack, first identified on a Monday morning, has led to outages affecting council websites, phone lines, and online reporting services, forcing the councils to invoke business continuity and emergency plans. The National Cyber Security Centre (NCSC) is assisting with remediation, and IT teams have implemented mitigations to restore services and protect data, though the full extent of the compromise remains under investigation. Authorities have stated that it is too early to determine the responsible party or the motive behind the attack, and investigations are ongoing to assess whether any data has been compromised. The councils have notified the Information Commissioner’s Office as a precaution and are prioritizing support for their most vulnerable residents. Residents have been advised of service disruptions and assured that updates will be provided as more information becomes available. Media reports suggesting Hackney Council was affected have been denied by officials.
Jun 29, 2026