30k primary pupils’ data may be at risk after Capita cyber attack

Dark web monitored for the information after company was targeted in March

Dark web monitored for the information after company was targeted in March


Tens of thousands of primary pupils’ details may have been stolen in a huge cyber-attack at government outsourcer Capita, Schools Week can reveal.

The dark web is being monitored for the information after the company was targeted in March, with 90 organisations reporting breaches of personal data held by Capita.

Capita runs several services for the Department for Education, including administering primary school SATs for the Standards and Testing Agency (STA).

Documents obtained by Schools Week reveal up to 30,000 pupil personal data records under the STA contract are “believed to have been exfiltrated”.

In its report to the Information Commissioner’s Office (ICO), the DfE said this included “pupil names, dates of birth, pupil IDs, test types and school reference numbers, in additional (sic) to other non-identifiable management data”.

It did not contain “any addresses for the pupils or contact details or names of schools, exam results; or any special category personal data or any financial information.

“Whilst name and date of birth are unlikely to present a high risk, should the information be made public for sale, it is likely to cause distress.

“The added inclusion of a school identifier may increase the likelihood of identification, but is unlikely to present a greater risk to the data subjects, unless there is a safeguarding issue potentially.”

However, in May the DfE said because there “is not a high risk posed, we are currently unlikely to inform the STA data subjects”.

Capita estimated the attack could cost up to £20 million.

‘Potentially compromised forever’

When asked about the SATs data breach, a spokesperson said it had “found no evidence of any information in circulation, on the dark web or otherwise, resulting from the cyber incident”.

Jen Persson, the director of the campaign group DefendDigitalMe, said children’s names and dates of birth was “critical identity data. These children and related family members are potentially compromised forever.

“If it’s not (yet) been put up for sale, it also begs the question who or what organisation might want children’s identities for what reasons.”

It was initially thought that several thousand teacher pension scheme members could also have been impacted.

But the DfE’s submission said in May only one member “most likely” had personal information taken.

It said Capita was monitoring the teacher’s account for “suspicious activity” and providing them with a 12-month membership of Experian Identity Plus, which alerts members to potential suspicious activity.

In the ICO report, the DfE said breached data figures have “changed several times (both up and down) and is not confirmed”. Neither the DfE nor Capita confirmed if the figure had changed as of this week, nor whether it had been communicated to pupils or their families.

The DfE said that almost all STA data was stored on uncompromised servers. A spokesperson said it was in “regular contact” with Capita as “it continues investigations”.

Data was taken from less than 0.1 per cent of Capita’s server estate, the company said in May.

“Having taken extensive steps to recover and secure our data … we still have found no evidence of any information in circulation, on the dark web or otherwise, resulting from the cyber incident,” it said in a statement this week.

An ICO spokesperson said it was “making enquiries” into the incident.

More from this theme


Reduced cash threatens ‘invaluable’ alternative provision pilot

AP specialist taskforces provide mental health professionals, family workers and speech and language therapists

Amy Walker

Ministers mull putting solar panels on disused school land

Plan would allow schools to generate their own electricity, says Baroness Barran

Samantha Booth

Still no RAAC cash as schools ‘sidelined’ in autumn statement

Treasury documents also suggest a £600m underspend on education capital projects last year

Freddie Whittaker

Keegan ‘deeply concerned’ as children miss school to join pro-Palestine protests

Education secretary says 'missing school for activism is unacceptable' as groups stage school strikes

Jack Dyson

Working in schools ‘unsustainably demanding’ as teacher wellbeing hits five-year low

The education workforce is 'stressed and unhappy at work,' warns teacher support charity

Samantha Booth

Schools invited to apply for free King Charles portrait

Portraits of the King will be printed on 'high quality paper' and mounted in a frame of ‘certified oak'...

Amy Walker

Your thoughts

Leave a Reply

Your email address will not be published. Required fields are marked *