Expanded Warning to Parents Over Cyber Attack on Schools
Parents of children attending an additional 16 schools in Northern Ireland have been alerted that their children's personal data may have been compromised in a recent cyber-attack.
The scope of the cyber-attack affecting schools in Northern Ireland has been found to be broader than initially reported. On Thursday, the Education Authority (EA) issued letters to parents indicating that their child's personal information might have been accessed during the incident.
The EA confirmed that notifications were sent to 23 schools in total, including 16 schools that had not previously been informed about potential data breaches related to the attack.
"We are committed to providing updates to schools who may be affected once new evidence emerges."
"Forensic investigations into the cyber-attack on the C2k school system are ongoing. This is a complex, detailed and lengthy process,"
According to the new correspondence sent to parents, at the time the incident occurred, there was no indication that their school was involved. However, subsequent forensic analysis has revealed a possibility that their child's personal data may have been accessed during the unauthorized cyber incident.
All online and IT services for schools across Northern Ireland are delivered via the C2k network, which was the target of the cyber-attack. The breach disrupted access to accounts for all schools and pupils, preventing students from logging in to obtain work or resources from teachers during the critical period leading up to exams.
'Upsetting News'
A 16-year-old male was arrested in connection with the cyber-attack but was later released on bail pending further investigation.
The letter from the EA's data protection officer stated that they are currently unable to confirm which specific personal data may have been affected. It also noted that further forensic analysis is ongoing to determine what, if any, data was accessed.
"This is expected to be a lengthy and detailed investigation, and we are committed to providing updates on key developments to anyone who may have been affected.
I appreciate that this news may be upsetting, especially given the ongoing uncertainty.
I sincerely apologise for any worry or frustration this situation may cause."
In an official statement, the EA announced that it has commissioned an independent review of the data breach and is cooperating with the Police Service of Northern Ireland in their criminal investigation.
Details of the C2k Network Incident
On 2 April, schools received a notification indicating that, as part of "work to manage an IT security issue," the EA would be initiating a password reset for all users.
The EA stated that "immediate steps" were taken to contain the security issue and that a comprehensive investigation is ongoing.
Following the cyber-attack, a full password reset was implemented across the entire school network as a critical security measure. The Education Authority also engaged with the Information Commissioner's Office and other relevant authorities as part of its response efforts.
An EA spokesperson emphasized that there is no evidence of any additional data breaches resulting from the attack since its detection.
"The latest validated evidence confirms a wider number of potentially impacted schools and individuals than originally indicated,"
"We are taking a proactive approach to reviewing emerging evidence, and further notifications will be issued as required as findings are confirmed."
- EA making 'good progress' to restore school IT systems after cyber attack
- School IT system targeted in cyber attack ahead of exam season
