Nova Education Trust

Summary

A cyber attack targeting an education trust managing multiple secondary schools in Nottinghamshire forced the shutdown of IT systems, disrupting all communication channels including email, phone services, and websites. The incident prevented remote teaching and access to new learning resources, requiring students to rely on consolidated materials and external educational platforms. Operational disruptions persisted as the trust coordinated updates through alternative channels while restoring network functionality. The attack impacted all affiliated institutions under the centralized management system, though no ransom demands or specific attack methodologies were publicly disclosed during initial response efforts.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On March 3, 2021, Nova Education Trust, which manages IT systems for 15 secondary schools across Nottinghamshire, experienced a cyber attack that disrupted operations. The Trust proactively shut down its entire IT network as a preventative measure, rendering all affiliated schools unable to access emails, websites, or internal communication systems. This outage immediately halted remote teaching capabilities, preventing educators from conducting live lessons or uploading new learning materials. The Trust issued a public statement at 8:15 AM that same day confirming the cyber attack and explaining the necessity of the network shutdown. With standard communication channels inoperable, the Trust directed stakeholders to monitor its website and individual school Twitter accounts for updates, explicitly stating no live instruction would occur that day. Students were advised to follow their regular timetables independently using third-party educational platforms like BBC Bitesize, Oak Academy, GCSE Pod, and Seneca to review prior coursework.

The attack caused sustained operational paralysis across all Trust-managed schools, with no restoration timeline provided in initial communications. Educational continuity relied entirely on students’ independent use of external online resources rather than institution-hosted materials or virtual classrooms. The Trust’s March 3 advisory emphasized consolidating recent learning through existing notes and specified alternative platforms, indicating an expectation of prolonged disruption. No details regarding the attack vector, threat actor, or data compromise were disclosed publicly. The centralized nature of the Trust’s IT infrastructure amplified the incident’s scope, affecting all 15 schools simultaneously without apparent variation in impact severity. Recovery efforts focused on maintaining basic communication through non-compromised channels while internal systems remained offline for investigation and remediation.

Sources

Sources available to members: 1 source.