{"id":234204,"date":"2025-09-05T13:00:00","date_gmt":"2025-09-05T12:00:00","guid":{"rendered":"https:\/\/schoolsweek.co.uk\/?p=234204"},"modified":"2025-09-05T16:51:29","modified_gmt":"2025-09-05T15:51:29","slug":"staff-want-compensation-after-summer-cyber-attack","status":"publish","type":"post","link":"https:\/\/schoolsweek.co.uk\/staff-want-compensation-after-summer-cyber-attack\/","title":{"rendered":"Staff want compensation after summer cyber-attack"},"content":{"rendered":"\n

Schools are facing compensation claims from distressed staff who have been told they face increased risk of identity theft after their personal details were \u201ccompromised\u201d in a cyber-attack over the summer.<\/p>\n\n\n\n

Investigations have been launched into whether criminals have seized the names and addresses, and phone, national insurance and passport numbers of staff.<\/p>\n\n\n\n

They follow a \u201cmalicious\u201d attack<\/a> on the software supplier of Single Central Record (SCR). The company says it manages more than 350,000 staff records at 1,500 schools. <\/p>\n\n\n\n

Schools are required by law to keep a single central record of data gathered in checks made on staff before they take up jobs. These can be maintained by external providers, such as SCR<\/a>, also known as Online SCR.<\/p>\n\n\n\n

Criminals claim ownership<\/strong><\/h3>\n\n\n\n

SCR was informed of the breach by its software supplier Intradev on Sunday, August 17.<\/p>\n\n\n\n

Steve Cheetham, Intradev\u2019s managing director, said the company \u201cidentified unauthorised activity within our systems\u201d on August 4 after a \u201csignificant IT security\u201d incident.<\/p>\n\n\n\n

Speaking on Thursday, he said a \u201ccriminal group has claimed to have taken some data from our systems. We are investigating this as a matter of priority and are coordinating with the relevant authorities.\u201d<\/p>\n\n\n\n

The breach has been reported to Action Fraud and the Information Commissioner\u2019s Office (ICO). <\/p>\n\n\n\n

SCR said it was unable to say how many schools have been hit, but it has provided schools with a list of affected staff.<\/p>\n\n\n\n

\u2018Identity theft risk\u2019<\/strong><\/h3>\n\n\n\n

\u201cBreach management\u201d documents sent to schools by SCR say the incident \u201cmay increase the risk of phishing, fraud attempts, and identity theft for affected individuals\u201d.<\/p>\n\n\n\n

Concerned teachers have taken to social media forum Reddit to ask for advice.<\/p>\n\n\n\n

One said they were \u201cfeeling very overwhelmed and worried about the potential impact that this could have\u201d.<\/p>\n\n\n\n

They also claimed they were informed a month after the breach happened on July 31.<\/p>\n\n\n\n

Under GDPR rules, organisations must report data breaches to the relevant authority within 72 hours, with those affected by high-risk incidents also informed \u201cwithout undue delay\u201d.<\/p>\n\n\n\n

SCR said the breach was a \u201cmoderate to high risk due to the sensitivity of the data involved\u201d, but no financial or criminal checks were compromised.<\/p>\n\n\n\n

In a blog post, Lucas Atkin, the head of information law at Stone King, said if criminals seized data, \u201cit is common [they]  threaten to release information on the dark web for auction unless a ransom is paid\u201d.<\/p>\n\n\n\n

Schools have been told to inform staff to be \u201caware\u201d of suspicious emails, phone calls, messages and phishing or impersonation attempts. <\/p>\n\n\n\n

They should also avoid \u201cclicking on unusual links\u201d and have been advised to \u201cconsider identity protection measures\u201d and to change passwords, including enabling two-factor authentication.<\/p>\n\n\n\n

\u2018Staff asking for compensation\u2019<\/strong><\/h3>\n\n\n\n

SCR also told schools to consider registering affected staff to CIFAS, a fraud prevention membership organisation, as a \u201crisk mitigation action\u201d. Membership costs \u00a330.<\/p>\n\n\n\n

Claire Archibald, legal director at Browne Jacobson, said staff were asking schools and trusts for compensation, and to pay for new passports.<\/p>\n\n\n\n

But she warned employers \u201cmust be careful\u201d as there was \u201cno duty on schools and trusts to make such payments\u201d.<\/p>\n\n\n\n

They would also likely qualify as \u201cnovel, contentious or repercussive transactions\u201d, which required government approval.<\/p>\n\n\n\n

Atkin advised schools to put Online SCR \u201con notice for any expenses of losses which may be incurred or suffered due to the breach\u201d.<\/p>\n\n\n\n

Attack a \u2018stark reminder\u2019<\/strong><\/h3>\n\n\n\n

Jay Ashcroft, a director of School SCR, another provider of record services, and a former trust data protection officer, said schools should \u201cimmediately undertake\u201d a comprehensive Data Protection Impact Assessment (DPIA) review of their contracts with Online SCR.<\/p>\n\n\n\n

But one expert, speaking anonymously, said they had spoken to trusts who had not completed a DPIA before entering into the contract \u2013 which could leave schools open to legal action.<\/p>\n\n\n\n

Chelmer Valley High School, in Essex, was reprimanded last year by the ICO for failing to complete at DPIA before introducing facial recognition technology for cashless catering.<\/p>\n\n\n\n

Atkin also claimed \u201cmost\u201d of the schools Stone King was advising \u201cwere not aware that Intradev was involved in the provision of Online SCR\u2019s services\u201d. <\/p>\n\n\n\n

Neither company responded to a request for comment about whether schools were told Intradev would have access to their personal data.<\/p>\n\n\n\n

Ashcroft said the incident was a \u201cstark reminder that schools can no longer afford to take a casual approach to data protection\u201d.<\/p>\n\n\n\n

Of the 67,000 data breaches reported to the ICO since 2019, 9,347 (14 per cent) were from the education and childcare sector. The only sector with more breaches was health (12,422).<\/p>\n\n\n\n

SCR said its systems \u201cremain incredibly secure\u201d and it has since revoked access from Intradev.<\/p>\n\n\n\n

Cheetham said the \u201cswift response\u201d of its IT team meant systems were \u201csuccessfully secured and recovered\u2026 which meant we were able to minimise operational disruption\u201d. <\/p>\n","protected":false},"excerpt":{"rendered":"

Schools warned incident could increase risk of phishing, fraud and identity theft for impacted employees<\/p>\n","protected":false},"author":73,"featured_media":234167,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"om_disable_all_campaigns":false,"footnotes":""},"categories":[4],"tags":[2389,1460,1748],"post-theme":[2398],"class_list":["post-234204","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news","tag-cyber-attack","tag-fraud","tag-legal-dispute","post-theme-schools"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t