Ransomware attack closed Charles Darwin School in Bromley for three days

Charles Darwin School, a secondary school and sixth form in Biggin Hill, in the London Borough of Bromley, told parents on September 6, 2024 that the IT problems it had been experiencing were the result of a ransomware attack. The school has around 1,320 students.

It closed from Monday September 9 to Wednesday September 11 while staff wiped and rebuilt devices and teachers reorganized lessons without access to digital materials. Internet, email and other school systems were expected to remain unavailable for an estimated three weeks. Student Microsoft 365 accounts were disabled and phone lines were restricted to emergencies.

Headteacher Aston Smith wrote to families that it was not yet clear what had been accessed, adding that there was the potential for all information held by the school to have been reached. The school reported the breach to the UK Information Commissioner's Office and engaged a cybersecurity firm to carry out a forensic investigation.

The BlackSuit ransomware group, widely described as a successor to the Conti operation, claimed the attack on its dark web leak site. According to The Register, the group said it had taken 200GB of data covering users, business records, employees, students and financial information. The school did not confirm that figure. Smith placed the incident alongside recent attacks on the NHS, Transport for London and other UK public sector bodies.