Cyberattack on UK Schools Exposes Sensitive Data in Vice Society Hack
In a series of targeted cyberattacks, the ransomware group Vice Society breached multiple UK schools, stealing and leaking highly sensitive documents on the dark web. Among the affected institutions was Pates Grammar School in Gloucestershire, where hackers accessed internal systems on 28 September 2022, disrupting IT infrastructure and phone lines. The school later confirmed unauthorized access by a third party on 7 October, affecting Microsoft Teams-based teaching materials and internal storage files.
The stolen data included passport scans of pupils and parents (dating back to 2011), staff contracts, pay scales, and confidential documents such as the headmaster’s salary and student bursary records. While the school initially stated there was "no evidence" of data theft, it later acknowledged that some files had been published on Vice Society’s dark web site a platform accessible only via specialized software and limited to technically skilled users.
Lampton School and Frances King School of English were also compromised, with the latter reporting no disruption to teaching despite the breach. The School of Oriental and African Studies (SOAS) confirmed a 2022 hack, with 18,680 files leaked, including staff contracts and budget details. Across the affected schools, hackers used generic search terms to extract comprehensive datasets, underscoring the vulnerability of under-resourced IT systems in education.
Vice Society, known for targeting education and healthcare sectors, typically demands ransom payments before leaking stolen data. The group has been linked to high-profile attacks in both the UK and US, including a 500GB data theft from the Los Angeles Unified School District. The Information Commissioner’s Office (ICO) and Gloucestershire Police are investigating the breaches, though some schools, like Lampton, claimed they were not required to notify affected individuals.
Cybersecurity experts note that schools are frequent targets due to limited cybersecurity resources, prioritizing education over digital defense. While Pates Grammar School stated it had restored systems, reset passwords, and implemented two-factor authentication, the incident highlights the growing threat to sensitive personal and institutional data in the sector.
Source: https://www.bbc.co.uk/news/uk-england-gloucestershire-63637883
Pate's Grammar School cybersecurity rating report: https://www.rankiteo.com/company/pate's-grammar-school
"id": "PAT1787716078",
"linkid": "pate's-grammar-school",
"type": "Ransomware",
"date": "9/2022",
"severity": "100",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Education',
'location': 'Gloucestershire, UK',
'name': 'Pates Grammar School',
'type': 'School'},
{'industry': 'Education',
'location': 'UK',
'name': 'Lampton School',
'type': 'School'},
{'industry': 'Education',
'location': 'UK',
'name': 'Frances King School of English',
'type': 'School'},
{'industry': 'Education',
'location': 'UK',
'name': 'School of Oriental and African Studies (SOAS)',
'type': 'University'}],
'data_breach': {'data_exfiltration': 'Yes',
'number_of_records_exposed': '18,680 (SOAS)',
'personally_identifiable_information': 'Passport scans, staff '
'contracts, student '
'bursary records',
'sensitivity_of_data': 'High',
'type_of_data_compromised': 'Personally identifiable '
'information, financial data, '
'confidential documents'},
'date_detected': '2022-09-28',
'date_publicly_disclosed': '2022-10-07',
'description': 'In a series of targeted cyberattacks, the ransomware group '
'Vice Society breached multiple UK schools, stealing and '
'leaking highly sensitive documents on the dark web. The '
'affected institutions included Pates Grammar School, Lampton '
'School, Frances King School of English, and the School of '
'Oriental and African Studies (SOAS). The stolen data included '
'passport scans, staff contracts, pay scales, and other '
'confidential documents.',
'impact': {'brand_reputation_impact': 'Yes',
'data_compromised': 'Passport scans, staff contracts, pay scales, '
'student bursary records, headmaster’s salary, '
'budget details',
'identity_theft_risk': 'High',
'operational_impact': 'Disruption to IT infrastructure and phone '
'lines, disruption to teaching materials',
'systems_affected': 'Microsoft Teams, internal storage files, IT '
'infrastructure, phone lines'},
'initial_access_broker': {'data_sold_on_dark_web': 'Yes'},
'investigation_status': 'Ongoing (ICO, Gloucestershire Police)',
'lessons_learned': 'Schools are frequent targets due to limited cybersecurity '
'resources. The incident highlights the need for improved '
'digital defense in the education sector.',
'motivation': 'Financial gain, data exfiltration',
'post_incident_analysis': {'corrective_actions': 'Systems restored, passwords '
'reset, two-factor '
'authentication implemented',
'root_causes': 'Limited cybersecurity resources in '
'education sector, vulnerability of '
'under-resourced IT systems'},
'ransomware': {'data_exfiltration': 'Yes',
'ransomware_strain': 'Vice Society'},
'recommendations': 'Implement stronger cybersecurity measures, prioritize '
'digital defense alongside education, and ensure timely '
'notification of affected individuals in case of breaches.',
'references': [{'source': 'Cyber Incident Description'}],
'regulatory_compliance': {'regulatory_notifications': 'ICO notified'},
'response': {'containment_measures': 'Systems restored, passwords reset, '
'two-factor authentication implemented',
'law_enforcement_notified': 'Yes (Gloucestershire Police, ICO)'},
'threat_actor': 'Vice Society',
'title': 'Cyberattack on UK Schools Exposes Sensitive Data in Vice Society '
'Hack',
'type': 'Ransomware'}