Why should we pay attention when local schools are attacked?

When one school in an area is hit, others nearby are often next. An attacker who compromises a staff email account gains access to the entire address book of local contacts. This is evident in that, within weeks of each other, multiple schools across the West Midlands and Lancashire were targeted in exactly this way.

So an attack on a neighbouring school is not someone else's problem. It is useful information. It tells you the methods being used in your area, often before they reach you, which gives you time to check your own policies and procedures. This blog explains how these attacks can spread and the practical steps that make the biggest difference.

What is email compromise?

Email compromise is when an attacker gains access to a real staff email account and sends messages as that person. They get in by stealing login credentials through phishing, guessing weak passwords, or running automated attacks such as brute-force.

Once inside, they are hard to spot. The emails come from a genuine address, sit in the right inbox threads, and often copy the tone of earlier messages. Staff have little reason to question them, which is exactly what makes the method so effective.

Why one local attack can become several

Put together, a single breach in your area can quickly become a pattern. That is why news of an attack at a nearby school is worth a few minutes of your attention: it is a prompt to check whether the same door is open at yours.

Three things tend to compound each other when we consider the possibility of a single local cyberattack escalating into several.

• Shared domain names. Schools in the same trust or region often use similar email structures, which makes it easier to find and target multiple organisations at once.
• Compromised address books. Once an attacker is inside one account, they have a ready-made list of trusted local contacts to go after next.
• Shared weaknesses. Schools in the same region or trust tend to run similar systems. Find one gap, and it often works elsewhere.

Who attackers go for, and why the board matters

Cybercriminals tend to target those with the most access. Leadership teams, business managers, and IT staff can authorise payments and access sensitive systems, so a compromised account in their hands opens the most doors.

It is worth knowing that responsibility no longer stops with the IT team. The latest DfE Cyber Security Standards expect governors and trustees to take ownership of cybersecurity. In practice, that means someone on the board should be able to answer a few simple questions: do we know our biggest risks, who is responsible for cybersecurity day to day, and what would we do if an account were compromised tomorrow?

You do not need to be technical to ask those questions well. If your board wants a quick way to get up to speed on what the standards expect, School Board Awareness Training covers the essentials in under 20 minutes. The format matters less than the outcome: a board that understands the risk and asks the right questions of its leadership team.

The steps that make the biggest difference

You can close most of the common gaps without a large budget. A few measures do most of the work.

Turn on multi-factor authentication. MFA is one of the most effective defences against account compromise, because a stolen password alone is no longer enough to get in. If you have not rolled it out yet, start with leadership, business and IT teams, then extend it to all staff. Wherever possible, use an authenticator app or key.

Do not overlook student accounts. Student email accounts are a common and underestimated way in. Consider restricting external email access, switching on MFA, and auditing folder permissions.

Get the basics right. Use unique, hard-to-guess passwords; the NCSC recommends three random words or a password manager. Keep individual staff email addresses off your website where you can, and use role-based or contact-form addresses instead. Remind staff that attackers use publicly shared personal details to guess passwords and write convincing messages. And make phishing awareness something staff revisit, not a one-off at induction.

Knowing where you stand

It is hard to fix what you cannot see. Before you decide where to spend time and money, it helps to have an honest picture of where your school is already strong and where it is exposed.

A self-assessment against the standards you are working towards is the simplest way to get that picture. Cyber score is a free, self-paced tool built for this. You answer a set of statements about what your school already does, which shows how you measure up against national expectations, such as the DfE Cyber Security Standards and Cyber Essentials, along with practical next steps. It is completely free to use, making it a cost-effective way to turn a vague sense of risk into a clear list of actions.

What to do if you receive a suspicious email

Even if a message appears to come from someone you know, pause and check. Were you expecting it? Does the content sound like them? Did it arrive at an odd time, or push you to act quickly? Urgency is a common pressure tactic, so treat "do this now" requests with extra care.

If something feels off, contact the sender directly through a separate channel. Phone them on a number you already have, not one included in the email.

It also helps to set up a dedicated reporting address, so staff can flag suspicious emails in one place without forwarding live phishing messages straight to colleagues.

Watch your suppliers too

Email compromise isn’t the only attack method to affect schools. Cybercriminals can take over a supplier's account and send fake invoices with altered bank details.

It’s always good practice to audit your suppliers, including current and potential ones. This helps flag any risks to the school and security gaps.

If a colleague does fall for an attack

These are sophisticated attacks that can fool anyone. The worst response is one that makes people afraid to own up, because a delay between the mistake and the report is what gives an attacker time to do real damage.

So the most useful thing a school can build is a culture where staff feel safe reporting mistakes straight away. Pair that with a simple incident response plan: who to tell and how to warn the rest of the school. When everyone knows their part to play, containment is far faster, and a compromised account becomes a contained incident rather than a top news story.

Want to see how Secure Schools can help prepare your staff for common cyber threats?

Request a demo from our team of experts here.