A criminal ransomware cyberattack has impacted the education network of a Scottish local authority today, officials have revealed.
Teachers working for West Lothian Council were impacted at around 7am this morning by the cyber breach – and were advised to disconnect their devices from the network, it is understood.
Police and Scottish Government teams have been supporting the council, which comes at a time when pupils are busily taking and preparing for national 5 and higher exams.
However, council officials confirmed they are working to ensure there is ‘minimal disruption’ to services and that Scottish Qualification Authority (SQA) exams will not be affected.
A West Lothian Council spokesperson said: “We have experienced a suspected criminal ransomware cyberattack on our education network today (Tuesday 6 May).
“This is a live criminal investigation, and we are working with all relevant external agencies including Police Scotland and the Scottish Government. There is no evidence that any personal or sensitive data has been accessed at this stage.”
The spokesperson added: “Contingency plans are in place to ensure our schools can operate with minimal disruption until this issue is resolved. All West Lothian Council schools will be open as normal this week, and SQA examinations will not be affected.
“There is no evidence at this time, that the council’s corporate and public access networks are affected by the attack.”
The council sent an internal memo titled ‘IT Services – Issue Affecting Education Network’ following the breach.
It advised all council staff to ‘extra vigilant around cyber security’ and to ‘delete any suspicious emails not from trusted sources’, especially those with links or attachments.
It said: “Any user who gets a pop-up message that begins, ‘”We have successfully breached your network,” should NOT click OK and should stop using the device immediately.'” Network users were then asked to inform their line manager and the IT service Helpdesk, to arrange for their device to be collected for examination.
West Lothian Council, which has its headquarters in Livingston, operates 68 primary, 13 secondary and 5 special schools, catering for 27,700 pupils.
A Police Scotland spokesperson said: “On Tuesday, 6 May, 2025, we received a report of a cyber incident in the West Lothian area. Enquiries are at an early stage.”
Jude McCorry, chief executive of Cyber and Fraud Centre – Scotland, added: “We are aware of a cyberattack affecting West Lothian Council’s education network. The attack is a live ongoing criminal investigation and the council will be working with all relevant agencies.
“Over the last few weeks, there have been significant cyberattacks against the likes of Marks and Spencers, Co-Op and Harrods, and now a local Scottish local council. This should be a reminder to all organisations, both large and small, that no one is immune to these criminal attacks, and to ensure they are as cyber resilient as possible with technology, training and working with their boards to ensure incident response plans are in place.
She added: “There are many free resources that organisations can access via the National Cyber Security Centre, Cyber Scotland and Cyber and Fraud Centre – Scotland websites.”
”If anyone needs support around a cyber attack please contact Police Scotland on 101 and our National Cyber Incident response line 0800 1670623.”
