West Lothian Council confirms school data stolen in Interlock ransomware attack

West Lothian Council disclosed on 6 May 2025 that its education network had been hit by a suspected criminal ransomware attack. The network supports schools across the Scottish local authority area, and council officials said at the time that they had found no evidence any data had been removed.

That position changed later in the month. The Interlock ransomware group listed the council on its leak site and began publishing files it said had been taken from the network. On 21 May the council confirmed that a small percentage of the data held on the education network had in fact been stolen. FutureScot reported that the gang dumped roughly 2.6 terabytes of material, made up of about 3.35 million files spread across more than 580,000 folders.

Most of the published material related to routine school operations such as lesson plans and teaching resources. A smaller portion was personal and sensitive. The Register reported that scanned passports and driving licences belonging to staff, parents and carers appeared on the leak site, alongside correspondence about individual pupils covering exam arrangements, homework and attendance. The council said confidential pupil records, financial data, bank details and social work files were held on separate systems that were not affected.

The council apologised to those affected, wrote to parents and staff, advised password changes and vigilance against scams, and worked with Police Scotland and the Scottish Government on the investigation. It said contingency arrangements kept disruption to SQA exams to a minimum.