A convincing email can take less than a minute to cause disruption across a school. A staff member enters their Microsoft 365 details into a false sign-in page, and an attacker may gain access to email, files, contacts and trusted internal conversations. Effective school phishing attack recovery is about more than changing a password. It is about containing the incident quickly, protecting pupils and personal data, and keeping teaching and administration running.
The first response sets the tone. Schools and academy trusts need a calm, documented process that separates urgent action from assumption. Moving too slowly gives an attacker time to spread. Moving without evidence can make it harder to understand what happened, meet reporting duties or prevent a repeat.
Treat the first report as a security incident
Staff should be encouraged to report suspicious messages and accidental clicks without fear of blame. People are far more likely to speak up promptly when the reporting culture is supportive. A teacher who says, “I entered my password and something did not look right,” may be reporting a compromised account, not simply an unwanted email.
The person receiving the report should record the basics: who received the email, when it arrived, what action was taken, whether credentials were entered, and whether any attachments or links were opened. Preserve the original message, including its headers where possible. Screenshots can help, but they are not a substitute for retaining the email itself.
If there is any possibility that credentials have been submitted, treat the account as compromised until checks show otherwise. This is particularly important for senior leaders, finance staff, HR teams, IT administrators and anyone with access to safeguarding, pupil or payroll information.
Contain access before the attacker expands it
The immediate priority is to stop unauthorised access. Reset the affected user’s password, revoke active sessions and require sign-in again across devices. If multi-factor authentication is not in place, enable it as part of the recovery work. If it is already enabled, check whether the attacker registered an alternative authentication method or approved a fraudulent sign-in request.
For Microsoft 365 and similar cloud platforms, containment should also include reviewing mailbox rules, forwarding settings, delegated access and recent sign-in activity. Attackers commonly create hidden inbox rules to intercept replies, delete warning emails or forward information externally. They may use a legitimate-looking account to send further phishing messages to colleagues, parents, suppliers or other schools in a trust.
Do not assume the incident is limited to one mailbox. Review whether the same email reached other staff and whether anyone else interacted with it. Search mail systems for the sender address, subject line, URLs and attachment names, then remove or quarantine matching messages where appropriate. This helps prevent a second wave of compromise while the first account is being investigated.
Where a device downloaded a file or showed unusual behaviour, isolate it from the network without switching it off unless advised by the incident team. Turning a device off can remove useful evidence. An IT provider can assess it for malware, stolen browser sessions or remote access tools before returning it to normal use.
Establish what the attacker could see and do
A proper school phishing attack recovery process needs a clear timeline. Review sign-in logs, email audit records, cloud storage activity and administrator changes from before the suspected compromise through to containment. The aim is to answer practical questions: did the attacker get in, what did they access, what did they send, and have they left a route back in?
Pay particular attention to sent items, deleted items, mailbox rules and unusual messages sent to finance teams or external contacts. Business email compromise often relies on timing rather than technical complexity. An attacker who has read messages about a school trip, facilities contract or invoice may send a believable request to change bank details or make an urgent payment.
Check for changes to bank details, supplier records, payroll instructions and purchase orders. Finance staff should independently verify any request to amend payment details using a known telephone number, not a number included in an email. If a payment has been made, speak to the bank immediately. Speed matters, even if recovery cannot be guaranteed.
The scope of the investigation should match the risk. A failed login attempt with no evidence of access requires a different response from an account used to view pupil records or send phishing emails across the organisation. The key is proportionate action supported by evidence, rather than a one-size-fits-all response.
Protect pupils, staff and the school’s legal position
Schools hold sensitive personal information, and phishing incidents can have safeguarding implications. If there is any concern that pupil information, safeguarding records, contact details or special category data may have been accessed, involve the designated safeguarding lead and senior leadership promptly. They need enough information to assess whether additional safeguards or communications are required.
Data protection responsibilities should be considered early, not after technical recovery. Under UK GDPR, an organisation must assess whether a personal data breach is likely to result in a risk to individuals’ rights and freedoms. Where it is, the Information Commissioner’s Office may need to be notified within 72 hours of becoming aware of the breach. If the risk is high, affected individuals may also need to be told in clear, practical language.
Not every phishing email is a reportable personal data breach. Equally, a lack of proof that data was downloaded does not automatically mean there was no risk. Keep a written record of the assessment, the evidence reviewed, decisions made and actions taken. This supports governance and gives school leaders a reliable account of events.
Communication should be accurate and measured. Staff need to know what to watch for and where to report concerns. Parents, suppliers or governors should only be contacted when there is a defined reason to do so. Speculation can create unnecessary alarm, while delayed communication can undermine trust when people have been affected.
Restore normal working safely
Recovery is not complete when the password has changed. Before closing the incident, confirm that affected accounts are using strong, unique credentials and multi-factor authentication, that malicious rules and sessions have been removed, and that endpoints have been checked where required. Confirm access to teaching resources, email, registers and key administrative systems is working as expected.
It is also sensible to review whether the incident exposed a dependency on one person or one platform. If a compromised account belongs to the only person who can authorise payments, manage admissions data or administer Microsoft 365, recovery becomes harder than it needs to be. Defined backup responsibilities and secure, role-based access reduce that operational risk.
For academy trusts, central IT teams should consider whether the same indicators of compromise appear across other schools. A shared identity platform can make containment faster, but it also means one poorly protected account may have wider consequences. Clear escalation routes between school leaders, trust teams and external technology partners are essential.
Turn the incident into a practical improvement plan
The most valuable outcome from a phishing incident is a more resilient school, not a longer policy document. Hold a short review once the immediate pressure has passed. Identify where the attack entered, which controls worked, what delayed the response and what would reduce disruption next time.
Technical improvements may include phishing protection, multi-factor authentication, conditional access controls, better monitoring and tested backups. Training matters too, but it should be relevant to the messages staff actually receive. A finance officer, teacher and headteacher face different risks and should understand the warning signs relevant to their role.
Run simple reporting exercises so staff know exactly how to flag a suspicious email. Test the incident plan with realistic scenarios, including a compromised senior leader account and a fraudulent payment request. The purpose is not to catch people out. It is to make the right actions familiar when the pressure is real.
A phishing incident can feel personal for the member of staff involved, but it is an organisational resilience issue. With prompt containment, sound evidence and clear leadership, schools can limit the impact and return attention to the work that matters most: providing a safe, consistent environment for pupils to learn.
