West Lothian council hit by ransomware attack on education network
Learn More
West Lothian Council in Scotland is reporting it is experiencing a "suspected criminal ransomware cyberattack" targeting its education network.
The council has implemented contingency plans "to ensure schools can operate with minimal disruption until this issue is resolved,"
West Lothian Council claims that here is "no evidence that any personal or sensitive data has been accessed at this stage" and that all schools in the area will "be open as normal this week". Student examinations for National 5, Higher and other qualifications "will not be affected"
The council's corporate and public access networks do not appear to be compromised by the attack. Details about the attack, any data accessed or impacted individuals are not disclosed.
Update - As of 21st of May 2025, West Lothian Council has confirmed that cyber criminals successfully stole personal and sensitive data during the attack. It affected IT systems used by the council's educational institutions, including 13 secondary schools, 69 primary schools, and 61 nurseries across the region. The attack was apparently perpetrated by the Interlock ransomware group.
The compromised information includes:
- Personal information of students and education staff
- Operational data such as lesson planning materials
- Scanned passports (at least one confirmed)
- Potentially medical information (cannot be ruled out)
- Potentially social work information (cannot be ruled out)
The number of affected individuals is not disclosed.
After Interlock posted what it claims is a trove of data belonging to the council this week, the authority confirmed "that a small percentage of the overall data stored on the education network has been stolen."
The incident has prompted a live criminal investigation with the council working alongside Police Scotland and the Scottish Government.
