Southampton’s St Anne’s Catholic School targeted by the Lynx ransomware gang

The Lynx ransomware group said it targeted St Anne’s Catholic School in Southampton, UK, in March and stole vast amounts of data from the school’s IT network.

 

The ransomware group posted on its data leak site that it stole confidential documents, contracts and financial data from the catholic school, threatening to leak the entire stolen dataset on 10th May unless a ransom was paid.

 

The group did not provide many details about the types of data it stole from the school’s network, nor did it share how much ransom it had demanded from the school administration in exchange for the stolen data. The school is yet to respond directly to the ransomware group’s claims.

 

St Anne’s Catholic School, which enrolls girls aged 11 to 18 years at Key Stages 3 and 4 and boys aged 16 to 18 years in its mixed Sixth Form College, suffered a severe ransomware incident on 23rd March which forced it to shut down for four days to regain access to its encrypted network.

 

The school’s headteacher Julian Waterfield said school authorities acted quickly to prevent the ransomware from spreading and quickly informed the Information Commissioner’s Office and the National Cyber Security Centre about the incident. Waterfield said there was no indication to conclude that any data had been compromised during the incident.

 

“We have also been supported by excellent experts and advisers, but cyber-crime is a highly specialised area, and we have had to take difficult decisions to protect both the school’s IT network and the safety of students and staff,” Waterfield said. “We would like to thank parents for their continued patience and understanding. Their messages of support have been greatly appreciated.”

 

In an incident update shared on 17th April, Waterfield reiterated that the ransomware incident did not result in loss of data and the disruption was restricted to temporary loss of control over the IT network that stored teaching resources and provided internet access for day-to-day operations.

 

“Recovery from the recent cyber incident continues, and we remain deeply grateful to all those who showed — and continue to show — such kindness, understanding and flexibility,” she added.