The majority of students at a high school in Buckinghamshire, England, were sent home for the second day in a row on Thursday after what the headteacher told parents was “a cybersecurity incident affecting our ICT systems.”

Great Marlow School, which has 1,428 pupils according to the Department for Education (DfE), said it was set to remain closed while it works with specialist IT and cybersecurity professionals to resolve the issue.

Only students sitting GCSE and A-Level external examinations were permitted to attend, with all other year groups advised to stay at home, said headteacher Guy Pendlebury in a statement on the school’s website, pledging to provide a further update by the end of the school day.

Pendlebury said the school was responding to the incident in line with guidance from the DfE and the National Cyber Security Centre (NCSC).

“The safety and well-being of our students, staff, and wider school community remain our highest priority at all times,” he added.

Data from the UK's Information Commissioner's Office (ICO), tracking cyber incidents in the education and childcare sector, records 1,959 incidents affecting the education and childcare sector between 2019 and 2025.

The figure for 2023 was 354 — the highest single year in the dataset — when ransomware gangs such as Vice Society attempted to extort schools by publishing sensitive files about at-risk children on their dark net websites.

The latest figures for attacks on schools cover 2025, when 259 incidents were reported to the ICO. Both the data protection regulator and the NCSC have expressed concern that ransomware victims are increasingly keeping incidents secret.

The British government is currently considering plans that would put legal obligations on ransomware attack victims to report the incidents to appropriate authorities.

The nature of the incident affecting Great Marlow School has not been confirmed. The ICO warned last year that student hackers motivated by dares are driving an increasing number of cyberattacks and data breaches affecting schools.

In April, a 16-year-old boy was arrested in Northern Ireland after a cyberattack disrupted access to educational systems used by potentially hundreds of thousands of students.

Earlier this year, Higham Lane School in Nuneaton, a town in central England, was also forced to close due to a cyberattack. 

It comes as the University of Nottingham, 100 miles north of Great Marlow School, separately confirmed a cyber incident — claimed by the Shiny Hunters cyberextortion gang — impacting a “significant amount” of data affecting both current and former students.

In the United States, the FCC has stated that disclosed cyber incidents at schools now number around 400 a year, with recovery times ranging from two to nine months.

Research has linked at least 75% of data breach incidents affecting U.S. public school districts to security incidents involving vendors. A recent attack on the popular learning tool Canvas was claimed to have affected more than 9,000 schools.

In November 2023, several U.S. schools and universities reported simultaneous outages amid a spate of ransomware attacks targeting educational institutions, with multiple districts coordinating with the FBI in a bid to address the threat.