Ransomware headlines tend to focus on big retailers, hospitals, and government agencies. But schools and colleges are an escalating, and in some ways more vulnerable, target, and a recent case shows exactly how indiscriminate the threat is.
A well thought-out plan gives you a structured approach to improving your security posture, identifying weaknesses, and ensuring a rapid response when an incident occurs. The goal is moving from reactive panic to proactive preparedness, and that starts with understanding exactly where you stand today, before building the plan and risk register that gets you further.
Across this series we've covered voice cloning, synthetic video, and AI-crafted phishing, three ways attackers are getting better at looking legitimate. But there's a quieter problem that does just as much damage: people notice something's wrong, and don't say anything.
Phishing remains one of the most prevalent and effective cyberattack methods, tricking millions into compromising their data every year. These deceptive messages, often arriving via email, text message (smishing), or phone call (vishing), are designed to look legitimate. They aim to trick you into revealing sensitive information like login credentials, credit card numbers, or personal data, or to click on malicious links that install malware. They may also be the start of a more complex cyber attack as a way into a system.
Yesterday we looked at voice cloning. Today's threat is more visually convincing : synthetic video. AI-generated footage that can show someone saying or doing something they never did, sometimes convincingly enough to fool the naked eye in real time.
This week, we're turning our Cyber Security Awareness Month series toward one of the fastest-growing threats facing schools and trusts: AI-generated deepfakes, starting with audio and voice cloning scams.
Cyber security can look like an IT problem, something for someone else to handle. It isn't. DPE has created as set of resources as a starting point to help you work out, role by role, who is accountable, who does the work, who should be consulted, and who just needs to be kept informed. Almost everyone in a trust or school appears somewhere on that list. That's the whole idea behind this year's theme: don't make it easy for them. Attackers rely on someone assuming it's not their job.
Whether your school's data lives in a server cupboard down the corridor or in the cloud, the same question applies: is it protected from unauthorised access, corruption or theft, throughout its whole lifecycle? Data security combines physical, technical and administrative safeguards, and getting all three right matters more as schools move more of their data off-site.
Cyber security and data protection sit side by side. Cyber security protects the systems; data protection governs what happens to the personal data inside them. In a school, that data is mostly about children, so the stakes are higher than in most sectors.
Yesterday we looked at why cyber security matters. Today we look at the people who protect personal data every day, and why an annual training module on its own rarely changes what they do.
October is Cyber Security Awareness Month, and this year's theme is "Don't Make It Easy for Them".
We don't think cyber security awareness is something to cover just once a year, but this month gives us a focus. Every day in October we'll share a short topic and one practical action you can take straight away.
The Department for Education confirmed that hackers have accessed its internal helpdesk and the Turing Scheme portal, taking more than 600,000 records. Contact details belonging to headteachers, senior school leaders, government officials and university staff were among the data taken, and some of it has since appeared on the dark web.
Understandably, this has caused a lot of anxiety across the sector and, predictably, a lot of speculation. Was this preventable? Should the DfE have done more? Who's to blame?
©2026 Data Protection Education Ltd.