Pupils, staff, and other data accessed in school cyber attack

Powys County Council has confirmed that personal data linked to a Powys school has been accessed following a cyber security incident affecting some school systems.

The council said the incident was first identified in April 2026 and was contained quickly, with immediate action taken to secure systems and prevent further unauthorised access. It is not known which school has been affected.

An investigation is now underway with support from specialist cybersecurity experts and partners.

Early findings have confirmed that personal data relating to pupils, staff and others connected to one school was accessed. The council has not yet identified the school involved and says work is continuing to determine the full extent of the breach and identify everyone affected.

In a joint statement, Powys County Councillors Raiff Devlin, Cabinet Member for Customers, Digital and Community Services, and James Gibson-Watt, Cabinet Member for a Learning Powys, said the incident would be concerning for parents, staff and the wider community.

“We understand that this incident will be very concerning for parents, staff and the wider community. We want to reassure people that immediate action was taken to secure systems, and a full investigation is underway with specialist support.

“We are contacting affected individuals directly where necessary and providing advice on steps they can take to protect themselves.

“The safety and wellbeing of pupils and staff remain our absolute priority, and we are committed to being transparent as our investigation progresses and will continue to support our schools throughout.”

The council said schools remain open and operational and there is currently no evidence that teaching or learning has been disrupted.

It has not disclosed what type of personal data was accessed or how many people may have been affected.

Further updates are expected as the investigation continues.

More information is available from Powys County Council at www.powys.gov.uk/CyberIncident.