Toggle menu
  1. Home
  2. Schools and Education
  3. Cyber Attack update - March 2026

Cyber Attack update - March 2026

The first phase of the recovery from last year's criminal cyberattack on our Education network is now complete.

Good progress has been made to restore systems lost, with a new Education network in place for the start of 2025/26 term to minimise disruption for pupils.

Steps have also been taken to identify anyone a risk from their sensitive information being lost, and we have contacted those affected.

The case remains an active criminal investigation, with Police Scotland and other partners still involved.

A small percentage of the total data stolen on the council's Education Network was stolen during a criminal cyberattack on 6 May 2025.

The majority of information held on this network relates to lesson planning and other materials required for schools for the delivery of education, but a small proportion of the files contained information of a personal and sensitive nature.

Please note that data was only taken from Holy Family Primary in Winchburgh and the following secondary schools: Armadale Academy; Bathgate Academy; Broxburn Academy; Deans Community High School; Inveralmond Community High School; James Young High School; Linlithgow Academy; St Kentigern's Academy; St. Margaret's Academy; West Calder High School; and Whitburn Academy.

There is no evidence that any data was compromised from any other schools, which includes primary, nursery, additional support needs schools or Winchburgh and Sinclair Academy. 

What do I need to do?

If you, or your children have never had any involvement of the schools concerned, then there no evidence your data has been lost.

There is no need for you to take any action, but we would still recommend you follow the guidance at our cyber security hub below.

If you or a child was involved with one of the schools affected between 2004 and May 2025, it is possible that your data is among that stolen.

For the vast majority, this is only likely to be limited personal info such as names, addresses, email addresses and phone numbers that could be available online via other means.

We would strongly recommend you take steps to take appropriate precautions as set out below.

A small percentage of files that were compromised contain information of a sensitive nature, shared with schools from partners such as social work, police and health.

Our staff have already worked to identify and contact those individuals deemed to be most at risk, with checks ongoing to identify anyone else who may be at risk and contact them where required.

If you have specific concerns about the potential theft of sensitive data impacting on you or your family, please send details in confidence to: educationcybersecurity@westlothian.gov.uk

Please note that as this is still a live criminal investigation and it may not be possible to provide all specific individual information requested.

What is not affected

There is no evidence that the council's corporate and public access networks have been affected.

All information held elsewhere in the council remains safe and secure, with extra measures in place to protect our networks.

What should I do now

As a precaution, everyone should be extra vigilant and be aware that there remains the possibility that any stolen data might be used for further criminal activity, such as phishing attacks or other scams.

Due to the increasing number of cyberattacks affecting a range of business and organisations, everyone is urged to be extra vigilant with their data online.

Passwords

What to do if my data has been lost

Cyber and Fraud Hub

Further updates

We will share any further updates as soon as we have them.

We would ask parents/carers not to contact their school or our customer contact centre regarding the cyberattack, as they do not have any more details than this at this stage. 

Any individual who has evidence that they have been the victim of a crime should contact Police Scotland on 101.