Bristol's schools, hit twice. Four lessons for your business.
A cyber attack took 88 schools offline in September. In October, records were taken from a primary school's management system. Here's what happened, and what any business can learn from it.
What's happened
In September, Bristol City Council disconnected internet access at 88 schools that use its Schools IT network, after a cyber attack. Local reports say suspicious activity was spotted on 21 September and the network was cut off on 25 September, to stop the attackers moving any further. Malicious software was found on some school devices. Most schools were back online within days, with security checks continuing at the rest.
In October, the council confirmed a second, separate incident. Southville Primary School's management information system (the system schools use for pupil records) was targeted, and there's evidence that records were exported. The council says that system isn't hosted on the Schools IT network, and that it believes the same criminals may be behind both attacks, though that hasn't been confirmed.
The breach has been reported to the Information Commissioner's Office, parents and carers have been told, and the council is working with cyber security experts and the Regional Organised Crime Unit. The council has said there's no evidence of a mass export of data from the wider schools network. It hasn't said what records were taken or how many people are affected.
Why this matters beyond schools
Schools aren't special targets because they're careless. They're targets because they hold valuable data, run on tight budgets and often share IT. That's true of plenty of businesses too. Nothing here is unique to education, and every lesson applies to an office, a practice or a shop.
Four lessons for your business
- Days matter. If the reports are right, there were four days between the first warning signs and the network being cut off. Attackers use that time to spread and steal. Ask yourself: if something odd showed up on your systems on a Monday, who would notice, and how quickly could they act?
- One shared network means one shared problem. Eighty-eight schools went offline together because they shared a network. If your offices, sites or departments all sit on one flat network, an attacker who gets into one can often reach the rest. Separating them is one of the most effective changes you can make.
- Your cloud systems need their own protection. The second attack went after a cloud-hosted system, not the network. Cutting off the network doesn't protect systems people log into from anywhere. That's what multi-factor authentication is for, along with knowing who has admin access.
- Know who you'd have to tell. The council reported the breach to the ICO and told parents. If personal data is taken, you may have 72 hours to report it. Here's how to decide whether to report a breach, so it isn't a decision you're making for the first time mid-incident.
If it happens to you
Disconnecting systems to contain an attack, like Bristol did, is often the right first move, but it's a hard call to make under pressure. If you're dealing with a cyber incident now, call before you start wiping or rebuilding anything. The evidence on those machines is how you find out what was taken.
For everything else, Cyber Essentials covers the basics that make attacks like these harder: firewalls between networks, secure settings, controlled admin access and up-to-date software.
Sources
Want to know how you'd cope?
I'll go through how quickly you'd spot an attack, how far it could spread, and who you'd need to tell. Plain English, no scare stories.