Parents connected to a Northern Ireland school scheduling application have been advised to monitor for suspicious communications following a data breach affecting nearly 50,000 users. According to BBC News, the Equipple app, which facilitates the booking and scheduling of parent-teacher meetings across multiple schools, experienced unauthorised access to its cloud infrastructure.
The breach potentially exposed parent contact information and certain pupil details, prompting schools to issue direct warnings to families. Equipple, the platform operator, stated in response that the incident has been contained and that security measures have been strengthened with assistance from independent cybersecurity experts.
This incident represents another significant security concern for Northern Ireland's education sector. Earlier in 2026, 16 additional schools were warned of possible data breaches following a separate cyber-attack on the C2k school network, with the Education Authority conducting ongoing forensic investigations into that incident.
What information was compromised?
The unauthorised access to Equipple's systems occurred for a limited timeframe before being detected and halted. According to communications sent by schools to parents, the compromised data included parent and carer contact details such as telephone numbers, home addresses and email addresses. Pupil information accessed in the breach encompassed names, dates of birth and registration groups.
One school's notification to parents, reviewed by BBC News, characterised the intrusion as having been identified immediately upon discovery. The school advised families to remain vigilant against any unexpected emails, telephone calls or other communications referencing them, their children or their school.
How is Equipple responding?
Equipple confirmed that it had identified the unauthorised access and immediately activated incident response procedures. The company secured the affected systems and, working alongside independent cybersecurity specialists, has implemented additional protective safeguards to prevent recurrence.
Equipple recently identified unauthorised access to part of its cloud-hosted environment and immediately activated its incident response procedures. We secured the affected systems and, with the support of independent cybersecurity specialists, have implemented additional safeguards.
In a statement to BBC News NI, an Equipple spokesperson emphasised that the matter is being treated with utmost seriousness and that there is currently no evidence of any ongoing unauthorised access to the platform. Schools were notified of the breach immediately, and the investigation continues with specialist support.
What are authorities doing?
The Education Authority (EA) information governance team has been engaged and is providing guidance to schools regarding their data protection obligations and appropriate next steps. Schools have been directed to communicate directly with parents and carers, providing relevant information and advice about the incident.
The EA spokesperson indicated that schools are reviewing whether any additional security measures beyond those already implemented are necessary to protect their systems and data going forward.
Broader context of school cyber threats
The Equipple breach reflects a wider pattern of cyber vulnerabilities affecting educational institutions. In November 2026, over 320,000 files stolen from Bristol City Council's schools server appeared on the dark web, affecting 39 schools that used the Trading with Schools platform following a September breach. Additionally, approximately 607,000 records were obtained in a cyber-attack on the Department for Education in England, though that breach did not compromise bank details or highly sensitive data.
What should parents do?
Parents and carers have been advised to remain alert to any unexpected communications that reference them, their child or their school. The precautionary guidance reflects standard cybersecurity protocols following data exposure incidents, as criminals may attempt to exploit compromised contact information for phishing, social engineering or other fraudulent purposes.
Schools continue to work with the Education Authority to assess the full scope of the incident and determine whether any additional protective actions are warranted for affected families.
