Schools

30k primary pupils’ data may be at risk after Capita cyber attack

Dark web monitored for the information after company was targeted in March

Dark web monitored for the information after company was targeted in March

Exclusive

Tens of thousands of primary pupils’ details may have been stolen in a huge cyber-attack at government outsourcer Capita, Schools Week can reveal.

The dark web is being monitored for the information after the company was targeted in March, with 90 organisations reporting breaches of personal data held by Capita.

Capita runs several services for the Department for Education, including administering primary school SATs for the Standards and Testing Agency (STA).

Documents obtained by Schools Week reveal up to 30,000 pupil personal data records under the STA contract are “believed to have been exfiltrated”.

In its report to the Information Commissioner’s Office (ICO), the DfE said this included “pupil names, dates of birth, pupil IDs, test types and school reference numbers, in additional (sic) to other non-identifiable management data”.

It did not contain “any addresses for the pupils or contact details or names of schools, exam results; or any special category personal data or any financial information.

“Whilst name and date of birth are unlikely to present a high risk, should the information be made public for sale, it is likely to cause distress.

“The added inclusion of a school identifier may increase the likelihood of identification, but is unlikely to present a greater risk to the data subjects, unless there is a safeguarding issue potentially.”

However, in May the DfE said because there “is not a high risk posed, we are currently unlikely to inform the STA data subjects”.

Capita estimated the attack could cost up to £20 million.

‘Potentially compromised forever’

When asked about the SATs data breach, a spokesperson said it had “found no evidence of any information in circulation, on the dark web or otherwise, resulting from the cyber incident”.

Jen Persson, the director of the campaign group DefendDigitalMe, said children’s names and dates of birth was “critical identity data. These children and related family members are potentially compromised forever.

“If it’s not (yet) been put up for sale, it also begs the question who or what organisation might want children’s identities for what reasons.”

It was initially thought that several thousand teacher pension scheme members could also have been impacted.

But the DfE’s submission said in May only one member “most likely” had personal information taken.

It said Capita was monitoring the teacher’s account for “suspicious activity” and providing them with a 12-month membership of Experian Identity Plus, which alerts members to potential suspicious activity.

In the ICO report, the DfE said breached data figures have “changed several times (both up and down) and is not confirmed”. Neither the DfE nor Capita confirmed if the figure had changed as of this week, nor whether it had been communicated to pupils or their families.

The DfE said that almost all STA data was stored on uncompromised servers. A spokesperson said it was in “regular contact” with Capita as “it continues investigations”.

Data was taken from less than 0.1 per cent of Capita’s server estate, the company said in May.

“Having taken extensive steps to recover and secure our data … we still have found no evidence of any information in circulation, on the dark web or otherwise, resulting from the cyber incident,” it said in a statement this week.

An ICO spokesperson said it was “making enquiries” into the incident.

Latest education roles from

Director of Governance – HRUC

Director of Governance – HRUC

FEA

Principal and CEO

Principal and CEO

Hills Road Sixth Form College

Senior Quality Officer

Senior Quality Officer

University of Lancashire

Chief Financial Officer

Chief Financial Officer

Minerva Learning Trust

Sponsored posts

Sponsored post

IncludEd Conference: Get Inclusion Ready

As we all clamber to make sense of the new Ofsted framework, it can be hard to know where...

SWAdvertorial
Sponsored post

Helping every learner use AI responsibly

AI didn’t wait to be invited into the classroom. It burst in mid-lesson. Across UK schools, pupils are already...

SWAdvertorial
Sponsored post

Retire Early, Live Fully: What Teachers Need to Consider First

Specialist Financial Adviser, William Adams, from Wesleyan Financial Services discusses what teachers should be considering when it comes to...

SWAdvertorial
Sponsored post

AI Safety: From DfE Guidance to Classroom Confidence

Darren Coxon, edtech consultant and AI education specialist, working with The National College, explores the DfE’s expectations for AI...

SWAdvertorial

More from this theme

Schools

School uniform: New rules to meet Labour’s cap revealed

Government guidance tells schools to confirm changes ASAP, consider legal advice and lets parents complain to government

Jack Dyson
Schools

AI could analyse lessons delivered by new teachers under NIOT pilot

Artificial intelligence could be used to analyse recordings of lessons by early career teachers under a new trial being...

Lydia Chantler-Hicks
Politics, Schools

Reform government would ‘root out teachers brainwashing kids’ says MP Lee Anderson

Reform UK members tell party conference of need to crack down on 'brainwashing' teachers and stop schools 'becoming indoctrination...

Lydia Chantler-Hicks
Schools

Farage: ‘Let’s start teaching trades and services at school’

Reform leader also says he ‘will not stand for kids’ minds being poisoned in schools with a twisted interpretation...

Lydia Chantler-Hicks

Your thoughts

Leave a Reply

Your email address will not be published. Required fields are marked *