How were schools and pupils affected by the C2K cyber attack?
Just at the start of the Easter holidays, an IT system called C2K was the target of a cyber attack. The attack disrupted access to digital tools used by schools across Northern Ireland at a critical point ahead of the exam season.
What is C2K?
Classroom 2000 is the centralised ICT managed service providing infrastructure, internet connectivity and curriculum software to all grant-aided schools in Northern Ireland. Operated for the Education Authority (EA) it supports over 80,000 devices and 320,00+ users via tools like My School and Capita services. It is essential to Northern Ireland schools, as it is considered the 'singular, centralised, non-redundant digital backbone' of the education system.
What happened?
It is unclear at the moment, exactly what has happened and the specific technical cause has not been disclosed. The EA advised pupils to reset their passwords and they were then unable to log back in. Many pupils had planned to do exam revision during the Easter holidays and had no access to their work. The password reset was to ensure that the network was not accessible; the passwords were reset for around 300,000 pupils and 20,000 teachers.
Currently there is no evidence that pupil or teacher data has been corrupted or stolen, though the ICO remains involved in the assessment of the breach.
Why should we worry?
This incident shows how disruption to a shared platform can immediately affect students, by restricting or denying access to core academic systems and resources.
It shows the dependency that schools have on a centralised digital infrastructure, but that this is heightened during critical academic periods like pre-exam periods.
What steps can we take?
Security Boulevard, suggests some practical steps:
- Build exam-period continuity plans: Ensure schools can continue revision, coursework access, and core communications during outages affecting central education platforms.
- Identify critical student-facing dependencies: Map which services, such as email, cloud storage, and learning platforms, create the greatest disruption when they become unavailable.
- Coordinate restoration with regulators early: Align incident response with education authorities and data protection bodies quickly when an attack disrupts systems used across multiple schools.
What is the fallout?
The BBC has shared some interviews with pupils affected by the cyber attack:
Pupils back to school in holidays to deal with fallout from cyber attack
Videos: Students dealing with fallout from school cyber attack