A ransomware attack targeted 12 schools under West Lothian Council, compromising social work reports and potentially exposing names, addresses, and email addresses of pupils. The attack, claimed by the group Interlock, involved the theft of sensitive data, with a threat to publish it if a ransom was not paid. While only a small proportion of the files were highly sensitive, the breach has raised concerns about phishing and scams targeting affected individuals. The council has contacted those at risk and is working with police to investigate the incident.
Source: https://www.bbc.com/news/articles/cdxl419eekxo
TPRM report: https://www.rankiteo.com/company/west-lothian-council
"id": "wes913080725",
"linkid": "west-lothian-council",
"type": "Ransomware",
"date": "7/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Education',
'location': 'Scotland',
'name': 'West Lothian Council',
'type': 'Local Authority'},
{'industry': 'Education',
'location': 'Scotland',
'name': 'Armadale Academy',
'type': 'School'},
{'industry': 'Education',
'location': 'Scotland',
'name': 'Bathgate Academy',
'type': 'School'},
{'industry': 'Education',
'location': 'Scotland',
'name': 'Broxburn Academy',
'type': 'School'},
{'industry': 'Education',
'location': 'Scotland',
'name': 'Deans Community High School',
'type': 'School'},
{'industry': 'Education',
'location': 'Scotland',
'name': 'Inveralmond Community High School',
'type': 'School'},
{'industry': 'Education',
'location': 'Scotland',
'name': 'James Young High School',
'type': 'School'},
{'industry': 'Education',
'location': 'Scotland',
'name': 'Linlithgow Academy',
'type': 'School'},
{'industry': 'Education',
'location': 'Scotland',
'name': "St Kentigern's Academy",
'type': 'School'},
{'industry': 'Education',
'location': 'Scotland',
'name': "St Margaret's Academy",
'type': 'School'},
{'industry': 'Education',
'location': 'Scotland',
'name': 'West Calder High School',
'type': 'School'},
{'industry': 'Education',
'location': 'Scotland',
'name': 'Whitburn Academy',
'type': 'School'},
{'industry': 'Education',
'location': 'Scotland',
'name': 'Holy Family Primary',
'type': 'School'}],
'customer_advisories': 'Parents have been urged to remain extra vigilant of '
'phishing attacks or scams.',
'data_breach': {'data_encryption': True,
'data_exfiltration': True,
'personally_identifiable_information': True,
'sensitivity_of_data': 'Low to moderate',
'type_of_data_compromised': ['social work reports',
'personal data']},
'date_detected': 'May 2025',
'date_publicly_disclosed': '2025-07-10',
'description': 'A ransomware attack on West Lothian Council affected 12 '
'schools, compromising social work reports and possibly names '
'and addresses of pupils. The attack is under police '
'investigation.',
'impact': {'data_compromised': ['social work reports',
'names',
'addresses',
'email addresses',
'learning materials'],
'identity_theft_risk': 'Possible'},
'investigation_status': 'Under police investigation',
'motivation': 'Financial gain',
'ransomware': {'data_encryption': True, 'data_exfiltration': True},
'references': [{'date_accessed': '2025-07-10', 'source': 'BBC Scotland News'}],
'response': {'communication_strategy': 'Parents have been urged to remain '
'extra vigilant of phishing attacks or '
'scams.',
'law_enforcement_notified': True},
'threat_actor': 'Interlock',
'title': 'West Lothian Council Cyber Attack',
'type': 'Ransomware Attack'}