Cyberattack confirmed as cause for phone and IT problems at British music school

A school in Guildford, southwest of London, has confirmed that a cyberattack is responsible for knocking out its phone lines and impacting the school’s IT systems.

Guildford County School, a specialist music academy with over 1,000 students, first announced IT issues on Twitter on January 19. At the time its headteacher Steve Smith said the incident would “not impact upon learning.”

In a statement sent to Surrey Live on Thursday, the school’s parent organization Learning Partners Academy Trust — comprising 12 state schools — confirmed that a cyberattack was responsible for the outages.

“Guildford County School detected a cyber-intrusion into its network on January 19 which affected the school IT systems, The school remains open to all students and the delivery of lessons continues, drawing upon the significant skill and experience of all staff members,” the spokesperson said.

The nature of the cyberattack has not been confirmed. Neither Guildford County School nor Learning Partners Academy Trust responded to The Record’s enquiries on Friday.

It comes amid a spate of ransomware attacks on education establishments in Britain — many conducted by the Vice Society ransomware group to extort victims by stealing sensitive data and threatening to release it unless a ransom is paid.

Earlier this month the BBC reported that highly confidential data stolen from 14 schools in the U.K. had recently been published by the group.

The National Cyber Security Centre published an alert in June 2021 warning of "an increased number of ransomware attacks affecting education establishments in the UK, including schools, colleges, and universities." Ransomware attacks have been a widespread problem for U.S. educational institutions, including recent incidents in the Los Angeles Unified School District and systems in Iowa and Massachusetts.

The NCSC has continued to reference an increase in attacks as recently as this month when it published a survey finding that, despite the threat continuing, schools were becoming “better prepared” for cyberattacks.

According to the Guildford County School spokesperson, there is “a robust backup regime in place, is being supported by a professional team and has taken immediate remedial action to limit data loss.”

They said: “Excellent progress is being made towards a full restoration of systems. The school is in contact with its Data Protection Officer and the ICO (Information Commissioner’s Office), in line with statutory requirements.”