A cyber incident is an event with threatens the confidentiality, integrity or availability of information systems, networks or the information they contain.
Review our previous article: What's a Cyber Incident and what should we do?
Cyber incidents can be intentional or accidental and can cause major disruptions. The recently reported CrowdStrike incident caused significant global disruption. While there are huge impacts to the affected systems, for which there are now fixes available, there will be an aftermath of 'unrest' where threat actors will use people's vulnerability and concern to send phishing emails.
The NCSC has already reported an increased in phishing activity as opportunistic and malicious actors seek to take advantage of the situation. The emails could be aimed at organisations or individuals.
The NCSC has released this guidance:
| Organisations should review NCSC guidance to make sure that multi-layer phishing mitigations are in place, while individuals should be alert to suspicious emails or messages on this topic and know what to look for. |
Their full report can be read here: NCSC Major IT Outage
We've made a short micro learning video for you to share with staff about how they might be affected by cyber incidents like this one:
View our other free micro learning videos!
Article images created using Microsoft Copilot AI.
Micro Learning video created using Vyond AI.
What to do in the event of a Cyber Attack
Tell someone! Report to IT. Report to SLT.Unplug the computer from the internet by removing the ethernet cable or turning the Wi-Fi off. Isolate the infected device and pass to IT
If you are a victim of a ransomware attack we would recommend reporting this to:
Action Fraud: https://www.actionfraud.police.uk/ as well as your data protection officer so they can advise about the data loss or your local police and ask for the cyber crime team or phone 101 and ask for the cyber crime team.
Most cyber crimes like these will also need to be reported to the ICO by your data protection officer. Our customers should email
These incidents should also be reported to the DfE sector cyber team at
Academy trusts have to report these attacks to ESFA.
Where the incident causes long term school closure, the closure of more than 1 school or serious financial damage, you should also inform the National Cyber Security Centre.
Always ensure there are backups you can restore from. Preserving evidence is as important as recovering from the crime.
Forward suspicious emails to