Cyber Incident Victim: Hardenhuish School

On or around the weekend prior to April 1, 2023, Hardenhuish School in Chippenham, Wiltshire, was the target of a cybersecurity attack. The school, which has 1,623 pupils, discovered that an external hacker had successfully gained access to its IT network. The specific point of entry and the exact initial access vector used by the threat actor were not detailed in the public communications. The attackers deployed ransomware onto the school's local servers, effectively seizing control of the core IT infrastructure. This malicious action encrypted systems and data, rendering them inaccessible to the school's administration and staff. Following the encryption of the network, the threat actors issued a ransom demand, a financial payment in exchange for the restoration of access to the compromised systems.

The school's administration detected the intrusion and confirmed the ransomware attack on March 31, 2023. Upon discovery, the incident was treated with high severity, prompting immediate internal response measures. The school's first public action was to notify all parents and guardians of the student body via a mass text message sent out on the day of discovery. This communication served to inform them of the breach, the nature of the attack, and its immediate disruptive consequences. The school was transparent about the ransom demand, stating explicitly that an external party was asking for money to restore the network. To assist with the technical investigation and recovery efforts, the school engaged external forensic specialists. These experts were brought in to conduct a detailed analysis of the attack, determine the full scope of the compromise, and aid in the recovery process. The forensic investigation was stated to be in its early stages, with the school awaiting further updates on whether any personal data was exfiltrated or viewed. Initial indications suggested that no personal data had been compromised, but this was not yet a definitive conclusion.

The impact of the ransomware attack was extensive and crippled a wide array of the school's critical operational systems. The primary effect was the complete unavailability of all IT services that depended on the school's local servers. This included the school's public-facing website, which was taken offline. The entire internal telephone system became inoperable, forcing staff to rely on personal mobile phones to communicate across the school site and with external parties. All printing capabilities were disabled. The school's Wi-Fi network and general internet access were also severed, significantly hindering administrative and educational functions that rely on online connectivity. The cashless catering system used for lunch payments was rendered inoperative, presenting a significant logistical challenge for managing student meals. The attack disrupted standard operational procedures, necessitating a shift to manual workarounds for core daily functions.

In response to the widespread system outages, the school implemented a series of immediate contingency plans to ensure the school could remain open and functional. A key decision was made to keep the physical site open and operating as normally as possible to minimize disruption to students' education. All lessons were scheduled to continue as planned. To manage attendance tracking without the digital management information system, the school reverted to using paper registers to record pupil attendance and absences. Students were advised to bring in their physical SmartCards for identification purposes to help facilitate the manual processes for lunch payments. Year 10 mock examinations and all scheduled extracurricular activities were confirmed to be continuing as planned, with any potential amendments to be communicated separately. Students who used their own personal IT devices to support their learning were still able to use them, though they could not connect to any school-provided internet services. The school provided specific reassurances that its safeguarding and emergency response systems remained fully functional and unaffected by the IT outage.

The recovery process was anticipated to be protracted. In its initial communication to parents, the school expressed hope that at least some of its processes and systems could be restored and brought back online by the beginning of the following week. The restoration efforts were dependent on the work of the forensic IT specialists and the success of recovery procedures. The school committed to keeping parents and guardians informed as the situation evolved and as more information became available from the ongoing investigation. The primary immediate consequences of the incident were severe operational disruption, the potential financial cost associated with the forensic investigation and recovery efforts, and the looming threat of a data breach should the investigation later reveal that personal information was accessed. The school faced the challenge of maintaining educational continuity while operating with severely degraded technological capabilities.