When a cyber attack happens, how quickly could your school recover?

Imagine arriving at school on Monday morning, switching on your computer and finding you can’t open anything.

Instead of your desktop, there’s a screen with a countdown timer and a demand for payment. Files on the network have been encrypted.

The office can’t reach the information it needs. Staff can’t open shared documents. Everyday work becomes very difficult.

At that point, the question is no longer whether the school has antivirus software. It’s how quickly you can recover, and what happens to the school while you do.

What recovery actually involves

Our Director of Technical Services, James Meer, has supported schools for many years. He has been called in to help a school recover from exactly this kind of ransomware attack.

Recovery wasn’t a case of switching everything off and on again. The affected systems had to be wiped and rebuilt, then the school’s data restored from backup.

There was a further complication. Ransomware can sit dormant inside files before it activates, so restoring a backup without checking it could bring the problem straight back. Restored data had to be checked and cleaned before it could be trusted.

“It was weeks and weeks to get them back up and running,” James remembers.

Where your data lives changes the recovery

One of the first things James looks at is where a school’s data is stored, because it can make a significant difference to recovery.

Physical servers may need rebuilding, while cloud-based services have different recovery arrangements.

Neither approach automatically guarantees a quicker restoration.

What matters is understanding the school’s particular setup, its backup arrangements and how recovery would actually be carried out.

Everyone with an account matters

James is clear that the biggest risk in any school isn’t the technology. It’s people, and that isn’t a criticism of anyone. People receive emails, open attachments and respond to requests that look genuine.

It isn’t only senior staff who are targeted. “Anyone is a risk in the school, from the lollipop lady who’s got an email account, all the way up to the business manager and headteacher,” James says.

If any one account is compromised, an attacker can see the school’s address book. They learn who’s who, and who to target next.

That’s why a culture where staff feel confident reporting something suspicious matters so much. If somebody clicks a link and nothing seems to happen, the safest thing is to tell someone straight away rather than hope for the best.

The email from someone you know

Most people are wary of emails from strangers. Fewer are wary of emails from colleagues, parents or suppliers they already deal with.

That’s exactly why attackers use compromised accounts. A message from a trusted contact is more likely to get past filters, and more likely to be opened.

James’s advice to staff is simple: “If you receive an email from a known contact, but it doesn’t fit with how you normally work with them and they’re asking you to do something, call them. ‘You sent me this file. Should I open it? I wasn’t expecting anything from you.’”

One phone call can prevent a great deal of harm.

When a nearby school is hit

James recently learned that another school nearby had been badly affected by a cyber attack. It wasn’t a school we support, and we won’t identify it.

Rather than wait, he raised the security settings across the schools ekte supports and wrote to school leaders explaining what to expect. That included the possibility that some genuine emails, such as newsletters, might be held back as suspicious for a while, and how to release them.

He also gave leaders a short message to copy and send to all staff: please be vigilant, security has been turned up, and here’s what that means for you.

Good cyber security isn’t only about tools. It’s also about telling people what’s happening and why, so they can play their part.

What helps a school recover

Prevention is always better than a cure. But James is honest about its limits: “With cyber security, you can never be 100% guaranteed that you won’t face an attack, even with the prevention steps in place.”

So, especially where budgets are tight, it makes sense to think in layers:

1. Reliable backups, with a tested way of restoring them. A backup that has never been successfully restored offers far less reassurance than one that has.
2. Alerts for unusual account activity. An account that suddenly sends hundreds of emails, sets up odd forwarding rules, deletes thousands of files or signs in from two countries within minutes can be locked automatically while someone investigates.
3. Protection on the devices themselves. This looks for unusual behaviour on laptops, PCs and servers, and is especially important where data is still stored on a server in school.
4. Practical staff training. Realistic practice emails help people get better at spotting what’s suspicious. James prefers the school to lead these campaigns, so awareness becomes part of school life rather than something the IT provider does to staff.

The right mix depends on the school’s set-up, particularly where its data lives.

Questions worth asking your IT support

• When did we last successfully test restoring our data?
• Is our data on a server in school, in the cloud or both, and how would that affect recovery?
• Would we be alerted if a staff account started behaving unusually?
• Who would respond to an alert, and what would we need to do as a school?
• Which systems would we restore first after a serious incident?

Where ekte fits

The DfE’s cyber security standard gives schools a framework for thinking about protection, responsibility and recovery.

At ekte, we help schools understand the risks in their own environment and choose proportionate ways to reduce them. You don’t need to become a cyber security expert. You need to know which questions to ask, and to have someone who will answer them plainly.

The important question isn’t whether you can guarantee nothing will go wrong. It’s whether you understand what happens if it does.