Update on Cyber Attack

Our immediate priority is notifying the individuals and schools impacted by the attack. That process is being urgently progressed, guided by the final findings of the investigation and advice from the PSNI and the Information Commissioner’s Office.

It remains the assessment of our system managers that the cyber incident is contained. Additional security measures were deployed at the beginning of this month on detection of the incident.

Intensive work continues to ensure schools are fully reconnected to the C2k system and that all impacted systems return to normal.

When did EA learn that the personal data of individuals had been compromised?

We were informed on the afternoon of Friday, 10 April 2026. The forensic experts undertaking the investigation of the cyber-attack advised that there had been specific and targeted access of personal data. We immediately informed the PSNI and the Information Commissioner's Office of this development.

We are making details of the emerging situation public now, following an arrest by the PSNI. We were unable to make any public statement before this point, to avoid compromising police inquiries.

Did EA not previously say they were advised no data had been compromised in the cyber incident?

Last week we were advised that the assessment at that point was that there was no evidence to date of data exfiltration or corruption - that was the basis for our statement at that time. We also made it clear that investigations were ongoing and the situation would continue to be monitored. The process of forensic analysis involves a thorough and systematic review of extensive data across various systems, which understandably requires significant time to complete.

This investigation has now pinpointed the accessing of personal information at a small number of schools.

This occurred prior to the additional cyber security measures that EA deployed after being notified of the cyber-attack at the beginning of this month.

Why are you not saying more about what data was accessed?

While we recognise our obligation to inform the individuals and schools that have been impacted as quickly as possible, we also must not do anything that compromises the integrity of an ongoing police investigation. That means we are constrained in what we can say publicly. We will provide a further public update when we can.

How will I know if my data has been compromised?

Individuals whose personal data have been compromised by this breach will be notified. We apologise sincerely for any concern this may cause and are making efforts to ensure they are informed as quickly as possible.

In the meantime, please ensure you have reset your C2k password as instructed by your school.