Cyberattack on UK Schools Exposes Sensitive Data in Vice Society Hack In a series of targeted cyberattacks, the ransomware group Vice Society breached multiple UK schools, stealing and leaking highly sensitive documents on the dark web. Among the affected institutions was Pates Grammar School in Gloucestershire, where hackers accessed internal systems on 28 September 2022, disrupting IT infrastructure and phone lines. The school later confirmed unauthorized access by a third party on 7 October, affecting Microsoft Teams-based teaching materials and internal storage files. The stolen data included passport scans of pupils and parents (dating back to 2011), staff contracts, pay scales, and confidential documents such as the headmaster’s salary and student bursary records. While the school initially stated there was "no evidence" of data theft, it later acknowledged that some files had been published on Vice Society’s dark web site a platform accessible only via specialized software and limited to technically skilled users. Lampton School and Frances King School of English were also compromised, with the latter reporting no disruption to teaching despite the breach. The School of Oriental and African Studies (SOAS) confirmed a 2022 hack, with 18,680 files leaked, including staff contracts and budget details. Across the affected schools, hackers used generic search terms to extract comprehensive datasets, underscoring the vulnerability of under-resourced IT systems in education. Vice Society, known for targeting education and healthcare sectors, typically demands ransom payments before leaking stolen data. The group has been linked to high-profile attacks in both the UK and US, including a 500GB data theft from the Los Angeles Unified School District. The Information Commissioner’s Office (ICO) and Gloucestershire Police are investigating the breaches, though some schools, like Lampton, claimed they were not required to notify affected individuals. Cybersecurity experts note that schools are frequent targets due to limited cybersecurity resources, prioritizing education over digital defense. While Pates Grammar School stated it had restored systems, reset passwords, and implemented two-factor authentication, the incident highlights the growing threat to sensitive personal and institutional data in the sector.