Shared school systems need clear boundaries and a tested way back

The school case brings a familiar problem into focus

Bitdefender’s investigation, published on 3 November, describes observed ransomware activity in a UK school estate from 10 to 19 September. It reports about 37 machines encrypted after an attacker connected previously separate account domains and reached other schools. The account includes backup credentials and an unmanaged machine. How the attacker first gained access is unknown. The researchers interpret some behaviour as consistent with AI assistance, while leaving the mechanism unproven. They describe one case, not a trend. The investigation establishes no connection to the PHP vulnerabilities.1

The question for a school meeting is where access can reach. Applications with separate names and contracts may depend on an important account or support connection. A useful review makes that relationship understandable to the people responsible for the school’s services.

The NCSC’s annual review, also published on 3 November, gives that discussion wider context. Its incident account identifies known vulnerabilities, stolen credentials, social engineering and supplier dependencies as continuing concerns. The AI use it observed had not enabled a novel class of attack. Its reporting period ends in August 2026, before the school incident. It provides national context, rather than corroboration of that case.2

There is a constructive message here. Schools can make worthwhile progress with established expertise and dependable controls. The task is to understand how those controls work together across the services the school actually uses.

Make the connections understandable to the people accepting the risk

Start with a service whose loss would seriously interrupt the school day. Ask its technical owner who can administer it, which other systems those accounts can reach and what would happen if that access were compromised. You need to understand why a connection exists and what protects it. Configurations and credentials should remain in protected technical records.

A trust’s central arrangements may sit alongside local purchases and exceptions. A maintained school may need its local authority and separate providers in the conversation. An independent school may have commissioned admissions, finance and boarding services through different agreements. In each setting, establish whether the technical boundaries match the responsibilities leaders believe they have agreed.

That discussion should reveal decisions people can make. Where broad access serves a legitimate operating need, ask competent staff to explain the safeguards and alternatives. Where responsibility is unclear, name the person who will resolve it. Governors can then see how a technical finding affects a choice about service, cost or risk.

Recovery has to work for the people using the service

A successful backup message is a useful start. It becomes more meaningful when the school understands who can alter or delete those copies, how recovery access is protected and what would remain available if an important administrative account were compromised.

NCSC backup guidance recommends protected copies of important information, separation where appropriate and checks that the copies work. The purpose is usable recovery when original data becomes unavailable. The suitable arrangement depends on the organisation’s needs and risks.7

Ask your support team what the latest restoration test demonstrated. Could authorised staff regain the information needed to resume work safely? Which limits or delays remained? Connect the answer to the service people use, including the hours when boarding staff need access. Agree how any temporary records would be protected and reconciled afterwards.

Recovery also needs a human handover. Someone must interpret an alert, someone must take technical action and a leader must authorise any operating restriction. Check cover and contact routes with the people who would use them. DfE’s existing recommended cyber standard supplies the England school context for coordinated responsibilities, response planning and recovery. Read it alongside the school’s safeguarding and continuity arrangements.6

Put accountability into the service the school agrees

The Cyber Security and Resilience Bill completed its Lords third reading on 2 November. Parliament reported the development on 3 November, and the stage record checked on 4 November lists Commons consideration of Lords amendments as the next step. Royal Assent and commencement remain separate milestones.34

The government’s summary proposes bringing medium and large managed service providers into scope and requiring relevant providers to inform customers likely to have been affected by an incident. The provider changes and reporting reforms depend on further regulations and commencement. This is not a new universal duty on schools or every IT provider.5

For today’s agreement, the useful conversation is already available: what information would the provider give the school, who would receive it and how would both parties coordinate a response? Ask what happens if the provider itself is disrupted. Clear answers help the school understand the continuing service it is purchasing.

Where that conversation exposes a gap, specialist work should leave the school better able to act. Give the provider a defined question about access, backup protection, monitoring or recovery. Agree the systems covered, operating constraints and findings required. A useful commission also explains how the specialist will work with existing support and who will carry each finding through to completion.

NCSC board guidance connects incident planning, response and recovery with organisational oversight. Governors need an intelligible account of what a review or exercise demonstrated, while competent staff retain the technical assessment. That gives leadership a basis for deciding whether further work, funding or a temporary restriction is needed.8

Bring the result into a concise working record: the critical service, the reach of relevant access, the technical owner, the recovery evidence and the decision still needed. Give unresolved items an owner and a review date. At the next meeting, ask what has improved and how the school knows. That is a practical return on the review: people understand the protection they depend on and the work still to do.