Back to Knowledge Vault

St Anne's School Ransomware: Files Must Live Offline

St Anne's Catholic School in Southampton was shut for four days after ransomware hit its network. It is not the first school to be targeted. From nurseries to councils, sensitive safeguarding data remains dangerously exposed on connected systems.

Originally reported by Curtis Lancaster, BBC News Southampton, 26 March 2026.

A School Under Siege

On 23 March 2026, parents of pupils at St Anne's Catholic School in Southampton received an alarming message: the school's entire IT network had been compromised by ransomware. Headteacher Julian Waterfield confirmed the school would close for four days while specialist teams worked to contain the attack.

The school reported the incident to the Information Commissioner's Office (ICO), the National Cyber Security Centre (NCSC), and police. In a statement, Mr Waterfield said there was currently "no evidence that any data has been compromised," adding that if that position changed, affected individuals would be contacted immediately.

The school praised the response of expert advisers but acknowledged the harsh reality: "Cyber-crime is a highly specialised area, and we have had to take difficult decisions to protect both the school's IT network and the safety of students and staff."

"No Evidence" Is Not the Same as "No Breach"

The phrase "no evidence that any data has been compromised" appears in almost every school ransomware disclosure. It is important to understand what this means. It does not mean data was not accessed. It means investigators have not yet found proof of exfiltration.

Modern ransomware groups routinely exfiltrate data before encrypting systems. The absence of evidence is not evidence of absence. In many cases, stolen data surfaces on dark web leak sites weeks or months after the initial attack.

For a school holding safeguarding records, SEN assessments, medical information, and child protection files, the consequences of a confirmed breach are severe and long lasting.

This Is Not an Isolated Incident

St Anne's is far from the first educational institution to be hit. The pattern is well established and deeply concerning.

Pates Grammar School, Cheltenham (2023): The Vice Society ransomware group breached the school and published stolen data on the dark web, including safeguarding reports and child protection documents. The ICO confirmed it was investigating.

14 Schools in the Harris Federation (2021): A coordinated ransomware attack struck 14 schools across London and the South East, affecting over 37,000 pupils. Financial records, HR files, and student data were all compromised.

Hackney Council (2020): The council suffered a major ransomware attack that exposed sensitive data including safeguarding referrals and housing records related to vulnerable residents and children. Recovery took over two years and cost millions.

Gateshead Council (2024): Confirmed that a cyber incident had affected children's services data, including safeguarding records. The council acknowledged that personal data relating to vulnerable children may have been accessed.

South Staffordshire Water / Cambridge Water (2022): The Cl0p ransomware group breached the parent company and leaked internal documents. While not a school, the attack demonstrated how critical national infrastructure holding personal data remains exposed.

Nurseries and Early Years Settings: Multiple nursery chains across England have reported data breaches involving access to child records, allergy information, and family contact details. These incidents often go unreported in national media but carry significant safeguarding implications.

What the NCSC Actually Advises

The NCSC provides specific guidance for education settings through its school cyber security guidance. Key recommendations include:

• Maintain offline backups that are disconnected from the network and tested regularly
• Implement multi-factor authentication on all administrative accounts
• Segment networks to prevent lateral movement during an attack
• Develop and test an incident response plan before an attack occurs
• Report incidents promptly to the NCSC, ICO, and Action Fraud

The NCSC is clear: organisations should assume they will be attacked and plan accordingly. The question is not whether a breach will happen, but whether critical data survives it.

Firevault View: The NCSC's guidance on offline backups is a helpful starting point for businesses and institutions. However, we believe that sensitive and valuable data, particularly safeguarding records, demands more than "offline" in the traditional sense. It requires physical disconnection.

The critical distinction is between IP-controlled and non-IP-controlled storage. A NAS device, a cloud archive, or an immutable backup all rely on IP connectivity and software-defined access controls. They remain reachable over a network. Credentials can be stolen. Admin interfaces can be compromised. Firmware can be exploited. These systems are offline in name only.

Non-IP-controlled storage operates on a fundamentally different principle. There is no network path to the data. No IP address. No admin portal. No API. The Firevault platform uses Layer 1 physical disconnection and an out-of-band control plane that sits entirely outside the school's IT infrastructure. The vault is unreachable by default. Not because of a firewall rule, not because of a permission setting, but because the physical connection does not exist until an authorised user initiates a governed session.

This is the difference between a locked door and no door at all. When safeguarding files are at stake, that distinction matters.

Why Safeguarding Files Demand Physical Isolation

School networks hold some of the most sensitive personal data in existence:

• Child protection and safeguarding referrals detailing abuse, neglect, and family court proceedings
• SEN Education, Health and Care Plans (EHCPs) containing medical diagnoses and behavioural assessments
• Looked-after children records with placement details and social worker notes
• Staff disciplinary and DBS records
• Medical information including allergies, medications, and mental health referrals

This data is governed by the UK GDPR, the Data Protection Act 2018, and the statutory safeguarding framework under Keeping Children Safe in Education (KCSIE). A breach involving this data triggers mandatory ICO reporting, potential regulatory action, and causes direct harm to children and families.

The regulatory burden is significant: fines of up to 4% of annual turnover under UK GDPR, plus the reputational and operational damage that follows. But the human cost is the real concern. When safeguarding data is leaked, it can endanger children, expose vulnerable families, and destroy trust in institutions that are meant to protect them.

The Firevault Approach: Disconnect to Protect

Firevault provides offline secure storage purpose-built for exactly this scenario. The architecture is simple and decisive:

• Physically disconnected by default. The vault has no persistent network connection. There is no IP address to attack, no port to scan, no credential to steal.
• Online only when needed. Data is accessible through a controlled, time-limited connection initiated by authorised personnel. When the session ends, the vault disconnects automatically.
• Out-of-band control plane. The connection mechanism operates outside the school's IT network, removing the risk of lateral movement from a compromised system.
• Zero standing privileges. No administrator has permanent access. Every connection requires explicit authorisation.
• CNI-grade data centres. Data is held on dedicated hardware in secure UK facilities, not shared cloud infrastructure.

This is not a backup solution. It is a resilience architecture. The critical distinction: even if ransomware encrypts every device on a school's network, the data in the vault remains untouched because it was never connected in the first place.

The Question Every School Leader Should Ask

After St Anne's, the question is not whether your school could be hit by ransomware. The 2025 Cyber Security Breaches Survey found that 70% of secondary schools and 74% of further education colleges identified a cyber attack in the previous 12 months.

The question is: if your network was encrypted tomorrow, would your safeguarding files survive?

If those files live on a server, a NAS, or in the cloud, the answer is uncertain. If they live in a physically disconnected vault, the answer is definitive.

Lock the digital door. Then turn the power off.

Share this article