West Lothian Council

West Lothian Council suffered a **criminal ransomware cyberattack** targeting its **education network**, disrupting operations across multiple schools. The attack, involving file-encrypting malware, forced the council to activate contingency measures to maintain school functionality while investigations proceed. Authorities, including **Police Scotland** and the **Scottish government**, are involved in the response. The incident highlights vulnerabilities in public sector infrastructure, with potential risks to **student and staff data**, administrative systems, and service continuity. While no explicit data breach (e.g., theft of personal/financial records) was confirmed in the report, the attack’s **disruptive nature**—compromising critical educational services—aligns with high-severity threats to organizational operations. The council’s reliance on backup systems and collaborative law enforcement efforts underscores the attack’s complexity and the broader implications for **local government cybersecurity resilience**.

Source: https://www.bbc.com/news/articles/cp8v836jr30o

TPRM report: https://www.rankiteo.com/company/west-lothian-council

"id": "wes807090225",
"linkid": "west-lothian-council",
"type": "Ransomware",
"date": "5/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization’s existence"

{'affected_entities': [{'industry': 'public sector / education',
                        'location': 'West Lothian, Scotland, UK',
                        'name': 'West Lothian Council',
                        'type': 'local government'}],
 'data_breach': {'data_encryption': True},
 'description': 'Schools in West Lothian have been the victim of a suspected '
                'criminal ransomware cyberattack. The attack affected the '
                "council's education network, prompting contingency plans to "
                'keep schools open. A criminal investigation is ongoing, with '
                'the council collaborating with Police Scotland and the '
                'Scottish government. Ransomware is a type of malware that '
                'encrypts files, preventing access to devices and stored data.',
 'impact': {'operational_impact': 'contingency plans activated to keep schools '
                                  'open',
            'systems_affected': ['education network']},
 'investigation_status': 'ongoing (criminal investigation with Police Scotland '
                         'and Scottish government)',
 'ransomware': {'data_encryption': True},
 'response': {'incident_response_plan_activated': True,
              'law_enforcement_notified': True,
              'recovery_measures': 'contingency plans to keep schools open',
              'third_party_assistance': ['Police Scotland',
                                         'Scottish government']},
 'threat_actor': 'suspected criminal',
 'title': 'West Lothian schools hit by ransomware cyberattack',
 'type': 'ransomware'}