The Department for Education (DfE) and the National Cyber Security Centre (NCSC) has been made aware of an increasing number of cyber-attacks involving ransomware infections affecting the education sector recently.
It is important that senior leaders in education settings understand the nature of the threat and the potential for ransomware to cause considerable damage to their institutions in terms of lost data and access to critical services.
The information below will support your ongoing cyber security preparedness and mitigation work.
What should I do if I am affected?
- Enact your incident management plan
- Contact the NCSC
- Contact your local law enforcement and Action Fraud
- Inform the Department for Education by emailing: sector.securityenquiries@education.gov.uk
The DfE supports the National Crime Agency’s recommendations not to encourage, endorse, or condone the payment of ransom demands.
Payment of ransoms has no guarantee of restoring access or services and will likely result in repeat incidents to educational settings.
It is vital that you urgently review your existing defences and take the necessary steps to protect your networks from cyber-attacks.
Along with your defences, having the ability to restore the systems and recover data from backups is vital. You should ask your IT team or provider to confirm that:
- they are backing up the right data
- the backups are held offline
- they have tested that they can restore services and recover data from the backups
Further information and supporting material include:
- NCSC Alert on the current cases of ransomware
- Ransomware advice and guidance for your IT teams to implement
- Offline backups in an online world
- Backing up your data
- Practical resources to help improve your cyber security