Ransomware attacks on secondary schools in Scotland (Fife)

Dear Rebecca Moody,

FREEDOM OF INFORMATION (SCOTLAND) ACT 2002 – REQUEST FOR INFORMATION

Thank you for your information request received on 02/02/2024 16:52 our ref FCIR: 50382 relating to Ransomware Attacks in Schools. This is being dealt with in terms of the Freedom of Information (Scotland) Act 2002.

We are presently assessing your request and may be in touch soon to ask for further clarification or to offer advice and assistance if we are not able to fulfil your request in its present form.

The legislation allows us up to 20 working days from the date that we receive a valid request, including any clarification we require, to make a final response. We will be in touch within 20 working days of receipt of your initial request to provide our response or to seek clarification where necessary. We hope to provide you with the information you are looking for at an earlier date where possible.

Yours sincerely,

James Brand
Fife Council

Dear Rebecca Moody

FREEDOM OF INFORMATION (SCOTLAND) ACT 2002 – REQUEST FOR INFORMATION

I refer to your information request received on 02/02/2024 our reference
FCIR: 50382. This is being dealt with under the Freedom of Information
(Scotland) Act 2002.

Request –

Please find below my FOI request regarding ransomware attacks on the
following schools/colleges:

- Queen Anne High School

- Levenmouth Academy

- Balwearie High School

- Dunfermline High School

- Bell Baxter High School

- Kirkcaldy High School

- Woodmill High School

- Auchmuty High School

- Inverkeithing High School

- Madras College

1. In the last 5 years, how many times has the school/college suffered
from a ransomware attack? Please provide specific dates (months/years) if
possible.

2. How much downtime did this cause (in hours)?

3. Did they pay the ransom? If so, how much was the ransom?

4. What type of ransomware was used?

5. What was the total cost of the incident to the school/college?

6. How many student and/or staff records were impacted in the breach?

Response -

Unfortunately it is not possible to provide you with the information you
have requested and a Refusal Notice is being issued under Section 30(c)(
Effective conduct of public affairs.

I am satisfied that this is exempt from release where disclosure of the
information would otherwise prejudice substantially, or be likely to
prejudice substantially, the effective conduct of public affairs.
Releasing this information into the public domain could potentially pose a
risk to the cyber security of our business.

In carrying out the public interest test I have concluded that although
there is a requirement for openness and transparency, this information is
integral to the council's security and release of such information may be
a security risk to the Council.

If you are dissatisfied with this response, you can ask us to carry out a
review of the decision.  You must do this in writing (or other permanent
form) within 40 working days of the date of this email.  Your review
should explain why you are dissatisfied with our response and we will
respond to you within 20 working days of receipt.  A review should be made
to the Head of Legal & Democratic Services:

Post: Head of Legal & Democratic Services

Finance & Corporate Services

Fife House

North Street

Glenrothes

KY7 5LY

Email: [email address]

If you remain dissatisfied following the review stage, you have the right
to appeal to the Scottish Information Commissioner for a decision. Please
refer to the following guidance on how to make a valid appeal:
www.itspublicknowledge.info/Appeal

Yours sincerely

S Guthrie

Information Management & Requests Team

show quoted sections

References

Visible links
1. http://www.fife.gov.uk/privacy