West Lothian Council has confirmed that cyber criminals stole “personal or sensitive” data during a ransomware attack on its education network. The local authority is now contacting parents, carers, and education staff to inform them of the breach and provide guidance.

The council stated that while most of the stolen data relates to operational school matters – such as lesson planning – officials have confirmed that some personal information was also taken.

Although confidential pupil records, financial data, and social work records are stored on separate systems, the council could not rule out the possibility that medical or social work details were compromised.

The attack, believed to be carried out by a group called Interlock, targeted the council’s education IT systems two weeks ago. Such groups typically encrypt an organisation’s files and demand payment under threat of leaking the data online.

In response, the council isolated the education network from its broader systems, with no evidence suggesting other services were affected. The breach came to light after officials were alerted to a scanned passport appearing online – though it remains unclear whether it belonged to a child or adult.

Despite the attack, schools remained open – with the incident coming on the eve of SQA exams.

In an statement, West Lothian Council said: “It has now been confirmed that a small percentage of the overall data stored on the education network has been stolen. We are aware that some personal or sensitive data is among the information stolen by criminals.

“Work is ongoing with the council and our partners to try and confirm the exact data which has been taken.

“Only a small amount of the overall data held on our education servers was stolen, and the majority of information held on them relates to operational issues for schools, such as lesson plans, that do not contain any personal details.

“We are aware that some personal or sensitive data is among the information stolen by criminals.

“Risk assessment has been carried out on any potential child protection issues at each of the schools affected, and appropriate action already taken if required.

The statement goes on to say that “as a precaution, everyone should be extra vigilant and be aware that there remains the possibility that any stolen data might be used for further criminal activity, such as phishing attacks or other scams.”

Recommended reading

• Are UK Businesses Ready for New ESG Rules?
• Cyber-threats and Fraud Costing Firms $100M Every Year
• VPN Security Fears Pushing Firms To ‘Zero Trust Everywhere’

Anyone impacted should contact The Cyber and Fraud Hub.

The council estimates that less than 10% of the server’s data was taken. It urged vigilance against potential misuse of the stolen information, such as phishing scams, and advised updating passwords with strong, unique alternatives.

Parents have been asked not to contact schools or council support lines for further details, as no additional information is currently available. Updates will be posted on the council’s website.