Schools across Inverclyde are suffering disruption after a “cyber incident”, with access to email systems blocked as a precaution while investigations continue.

In an email sent to parents and shared online, Inverclyde Council said it had activated its “response plans” after a user account was found to have been compromised. While schools opened as normal on Monday, the council confirmed that systems had been taken offline to allow work to determine the cause and impact of the incident.

Parents were told that schools and nurseries would not be able to access emails during this period. There may also be difficulties accessing school lunch pre-order apps, particularly in secondary schools, although lunches and breakfast clubs are operating as normal. School transport has not been affected.

The council has not confirmed the nature of the cyber incident, nor whether any data has been accessed. Inverclyde is home to six secondary schools, 20 primary schools and 20 nurseries.

In the message issued to parents on Sunday 18 January 2026, the council said: ‘We are contacting you today to highlight a recent cyber incident where a user account has been compromised.

‘All schools and early year establishments will open as normal on Monday morning.

‘We have activated our response plans and as a precautionary step, we have taken our schools temporarily offline while we investigate.

‘Work to determine the cause and impact of this continues and we are liaising with school teams and our suppliers to minimise disruption.

‘Schools and early years centres will not be able to access emails but if you have an urgent email, please contact admin.educationhq@inverclyde.gov.uk

‘School lunches and breakfast clubs will operate as normal however there may be difficulties accessing the pre-order app in secondary and your child may have to order lunch at the school canteen.

‘School transport is unaffected.

‘We apologise for any inconvenience and thank you for your continued patience.

‘We will provide more information as soon as we can.’

DIGIT has approached Inverclyde Council for comment.

Commenting on the incident, Ryan McConechy, chief technology officer at Barrier Networks, said: “We don’t know what type of cyber incident Inverclyde is facing, but it looks like the websites of many of the schools have been taken down, which suggests the council is actively working to contain the incident.

“Fortunately, the incident doesn’t appear to be related to ransomware and the schools are open as normal, but the council’s notice does suggest a user education account has been compromised.

“This could mean an unauthorised user has gained access to systems and the council is actively working to find them and lock them out before more damage is caused.”

McConechy added that concerns around pupil data were understandable, but said it was too early to draw conclusions. “Parents will undoubtedly be concerned about the impacts of a cyber incident on pupil data, but at this stage it’s not possible to say what, if any, data has been accessed,” he said.

Recommended reading

• £1.9 Million Boost for Scottish Entrepreneurship Education
• Scot Gov Expands Entrepreneurial Education Fund
• New EdTech Innovation Hub Launches for Scottish Higher Education

He advised parents and carers to remain cautious online, adding: “Be vigilant for phishing emails or correspondence claiming to be from schools or the council where further personal information is being requested. It’s always safer to visit the official Inverclyde council website for information around the incident and its containment.”

McConechy also warned that cyber-attacks targeting the education sector are becoming more common. “Attacks on schools and further and higher education are becoming more prevalent today and there has recently been a spate of ransomware assaults, which have impacted pupil data and caused schools to close. Fortunately this doesn’t appear to be the case here.

“But the education sector must take the threat seriously, ensuring defences are layered covering all on premise and cloud environments, and that incident response planning and recovery is prioritised.”