Loading story…
A 16-year-old boy was arrested in Portadown, County Armagh, on suspicion of offenses under the Computer Misuse Act after a targeted cyberattack disrupted Northern Ireland’s centralized C2K school IT network. The Police Service of Northern Ireland said the suspect was later released while its cybercrime team continues investigating. The attack forced the Education Authority to take C2K offline to contain the incident, cutting off access to online teaching materials, assignments, exam revision resources, and communication tools used by most schools across the region.
The Education Authority, working with service provider Capita and an incident response firm, said the breach affected a small number of schools and is believed to have compromised some personal data. Officials said the incident is currently assessed as contained, with no evidence of data corruption and recovery underway through password resets, added security measures, and phased restoration of services. Reconnection is being prioritized for pupils at critical academic stages, particularly those preparing for examinations, while authorities coordinate the investigation and any required notifications with the PSNI and the Information Commissioner’s Office.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
In a Friday update, Northern Ireland's Education Authority said the C2K school IT environment had been largely restored after the cyberattack. It reported that 414,000 pupil, teacher, and staff accounts had been successfully reconnected, returning operations to near-normal levels.
Police in Northern Ireland arrested a 16-year-old boy in Portadown, County Armagh, on suspicion of Computer Misuse Act offenses linked to the C2K cyberattack. He was later released while the PSNI cybercrime team continued its investigation.
The Education Authority later described the incident as a targeted attack affecting a small number of schools and said it is believed to have compromised some personal data. It also said the attack was assessed as contained and that notifications were being coordinated with the PSNI and the Information Commissioner’s Office.
Following detection of the incident, the Education Authority launched an investigation with Capita, an incident response company, and law enforcement while beginning password resets and phased restoration of services. Recovery was prioritized for pupils at critical academic stages, especially those preparing for examinations.
The Education Authority detected a cyberattack against the centralized C2K IT network used by most schools in Northern Ireland and deployed additional security measures to contain it. Access to the platform was shut down, disrupting teaching materials, assignments, exam revision, and communications for affected schools.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
databreaches.net
Open sourcedatabreaches.net
Open sourcetherecord.media
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two 17-year-old boys were arrested in Bishop’s Stortford, Hertfordshire, in connection with a cyberattack and attempted extortion targeting the British nursery school chain Kido. The Metropolitan Police Service led the investigation after receiving a referral about a ransomware attack on September 25. The attackers gained unauthorized access to sensitive data, including pictures and names of children enrolled at Kido’s nursery schools, as well as addresses and contact details for their parents and carers. The perpetrators published images and personal information of 20 children online, out of an estimated 8,000 children affected by the breach. This exposure significantly increased the risk to the children’s safety and wellbeing, prompting widespread concern among parents, carers, and the cybersecurity community. The attackers used the stolen contact information to make threatening phone calls to parents and carers, escalating pressure on Kido to pay an extortion demand in bitcoin. The incident was described by cybersecurity experts as a disturbing evolution in criminal tactics, given the targeting of vulnerable children and the use of their personal data for extortion. The Metropolitan Police’s cybercrime unit worked swiftly to identify and apprehend the suspects, who remain in custody for questioning on suspicion of computer misuse and blackmail. The breach and subsequent extortion attempt have been condemned by both law enforcement and cybersecurity professionals, highlighting the emotional and psychological impact on the affected families. The authorities have reassured the public that they are taking the matter seriously and are providing support to those impacted. The case has raised broader concerns about the security of sensitive data held by educational institutions and the potential for such information to be weaponized by cybercriminals. The incident has also sparked discussions about the need for enhanced cybersecurity measures and awareness in the education sector. Law enforcement officials have emphasized the importance of reporting cyber incidents promptly to facilitate rapid response and investigation. The arrests represent a significant development in the ongoing investigation, but the full extent of the breach and its long-term consequences for the victims are still being assessed. The Kido nursery chain is cooperating with authorities and has taken steps to notify affected families and bolster its cybersecurity defenses. The case serves as a stark reminder of the evolving threat landscape and the need for vigilance in protecting sensitive information, especially when it concerns children.
Jun 29, 2026
A breach tied to **PowerSchool**, a widely used K-12 software provider, exposed student and teacher information from school districts across the U.S., including New Jersey districts where officials said data on students and educators was stolen in a nationwide cyberattack. Reporting on the incident said the compromise affected records held by schools using the platform, raising concerns about the scale of exposure across the education sector and the security of sensitive K-12 data. Separately, **Spring Lake Park Schools** in Minnesota canceled classes and shut down technology systems after an outside actor gained unauthorized access to district networks in what officials described as a suspected ransomware incident. The disruption affected classes, child care, community education, and after-school programs, while the district worked with third-party cybersecurity experts, state law enforcement, and the **FBI** to contain the intrusion and restore operations; officials later said classes would resume and that they had no evidence at that point that personal information had been affected.
Jun 29, 2026
Higham Lane School in Nuneaton, England, was forced to close to all students and staff following a significant cyberattack that crippled its IT infrastructure. The attack rendered critical digital services, including telephones, email, and the school's management system, inoperable, prompting the administration to suspend in-person classes and issue a strict directive for students and staff not to log into any school systems, such as Google Classroom and SharePoint. The school engaged external cybersecurity specialists and a Cyber Incident Response Team from the Department for Education to investigate and contain the breach, while also notifying the Information Commissioner’s Office (ICO) as required by law. The Central England Academy Trust, which oversees Higham Lane School, confirmed that incident response protocols were activated and that the full scope of the attack was still being assessed. While the nature of the incident and whether any data was exfiltrated remain unclear, the school administration emphasized the seriousness of the compromise and the need for maximum caution. The closure follows a broader trend of cyberattacks targeting the UK education sector, with over 80 ransomware incidents reported to the ICO in 2024, some of which also resulted in school closures and extortion attempts.
Jun 29, 2026