Education for the 21st Century Trust

Summary

A cyber incident disrupted internet access across multiple school devices within the E21c Education for the 21st Century Trust, impacting ancillary systems including phones and printers. Temporary communication protocols were established for parents while schools remained operational. The organization engaged its Data Protection Officer, notified the ICO in compliance with GDPR obligations, and initiated remedial measures to mitigate data loss and restore services. Relevant authorities are investigating the incident, with urgent inquiries directed to designated contact channels.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On July 1, 2024, E21C Education for the 21st Century Trust publicly disclosed an ongoing cyber incident disrupting operational technology across its school network. The attack compromised internet access for numerous school-managed devices, creating cascading failures in dependent systems including telephony and printing infrastructure. Despite these technical limitations, all schools maintained physical operations without closure, implementing alternative communication protocols to preserve continuity of education. The Trust established temporary contact channels for parents and carers, redirecting inquiries through designated email addresses and a published mobile number (07725 211743) for urgent matters while primary systems remained inoperable. Internal assessments confirmed immediate functional impacts but did not initially quantify potential data exposure or establish intrusion vectors.

E21C's incident response protocol activated statutory reporting obligations under the Data Protection Act 2018 and GDPR within confirmed timelines, with formal notifications submitted to both the Information Commissioner's Office (ICO) and the Trust's Data Protection Officer. Technical teams implemented containment measures described as "immediate remedial action" to inhibit further data exfiltration and initiate system restoration processes, though specific technical controls were not detailed in public communications. External investigative support was engaged through unspecified "relevant authorities," with no attribution claims or threat actor details released. The Trust maintained centralized crisis communication through its website, directing stakeholders to institution-specific contact details while preserving [email protected] as a primary trust-level coordination point throughout the disruption period. No ransomware notes, financial demands, or data disclosure evidence entered public reporting channels during the initial disclosure phase.

Sources

Sources available to members: 1 source.